Notes on TIA Portal 1

STEP 7 2

WinCC 3

Safety 4
Readme SIMATIC Energy Suite
5
Readme

TIA Portal Version Control

Interface 6
Programming and Operating Manual

11/2019
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.

DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.

WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.

CAUTION
indicates that minor personal injury can result if proper precautions are not taken.

NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will be
used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to property
damage.
Qualified Personnel
The product/system described in this documentation may be operated only by personnel qualified for the specific
task in accordance with the relevant documentation, in particular its warning notices and safety instructions. Qualified
personnel are those who, based on their training and experience, are capable of identifying risks and avoiding
potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:

WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended or
approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and
maintenance are required to ensure that the products operate safely and without any problems. The permissible
ambient conditions must be complied with. The information in the relevant documentation must be observed.

Trademarks
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software described.
Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the information in this
publication is reviewed regularly and any necessary corrections are included in subsequent editions.

Siemens AG Copyright © Siemens AG 2019.

Division Digital Factory Ⓟ 11/2019 Subject to change All rights reserved
Postfach 48 48
90026 NÜRNBERG
GERMANY
Table of contents

1 Notes on TIA Portal ......................................................................................................................................7

1.1 General notes...........................................................................................................................7
1.2 Notes on libraries ...................................................................................................................10
1.3 Notes on memory cards .........................................................................................................11
1.4 Notes on using TIA Portal in a virtual environment (private cloud) ........................................12
1.5 Notes on using the TIA Portal Teamcenter Gateway.............................................................13
1.6 Information on working with Multiuser Engineering................................................................16
2 STEP 7 .......................................................................................................................................................19
2.1 Security information ...............................................................................................................19
2.2 Notes on use ..........................................................................................................................21
2.3 Simultaneous online operation...............................................................................................22
2.4 Editing devices and networks.................................................................................................23
2.4.1 General information on devices and networks .......................................................................23
2.4.2 Notes on the hardware configuration .....................................................................................23
2.4.3 Information about OPC UA functions .....................................................................................23
2.4.4 Hardware detection of IO devices ..........................................................................................29
2.4.5 HW ID of type "Hw_SubModule" for an HMI Panel IO device ................................................29
2.4.6 Use of modules on the S7-1200.............................................................................................30
2.4.7 CP 343-2 on SIMATIC S7 Embedded Controller EC31-RTX.................................................31
2.4.8 Loading of S7-1500 CPUs (SIPLUS) .....................................................................................31
2.4.9 ET 200MP (IM 155-5 DP ST) on a WinLC RTX .....................................................................32
2.4.10 Notes on online and diagnostics ............................................................................................33
2.4.11 Network components .............................................................................................................33
[Link] Network and communication modules ...................................................................................33
2.5 Programming a PLC...............................................................................................................39
2.5.1 General notes on PLC programming .....................................................................................39
2.5.2 Notes on instructions..............................................................................................................40
2.5.3 Testing the user program .......................................................................................................41
[Link] Information on testing with the watch table ............................................................................41
[Link] Information on testing with the force table .............................................................................42
[Link] Information on testing with breakpoints..................................................................................42
2.5.4 Upgrading blocks ...................................................................................................................43
2.5.5 Compatibility of PLC programs from older versions...............................................................44
[Link] Compatibility of PLC programs from versions prior to V16 ....................................................44
[Link] Compatibility of PLC programs from versions prior to V15.1 .................................................47
[Link] Compatibility of PLC programs from versions prior to V15 ....................................................49
[Link] Compatibility of PLC programs from versions prior to V14 SP1 ............................................53
[Link] Compatibility of PLC programs from versions prior to V14 ....................................................54
[Link] Compatibility of PLC programs from versions prior to V13 SP1 ............................................59
2.6 Inter Project Engineering (IPE) ..............................................................................................65

Readme
Programming and Operating Manual, 11/2019 3
Table of contents

2.6.1 Notes on IPE ..........................................................................................................................65

2.7 Technological functions..........................................................................................................66
2.7.1 Notes on S7-1500 Motion Control..........................................................................................66
2.7.2 Notes on additional technology functions...............................................................................69
2.7.3 Notes on technological functions ...........................................................................................70
2.7.4 Notes on technological functions ...........................................................................................70
2.7.5 SIMATIC STEP 7 Easy Motion Control..................................................................................71
[Link] Notes on SIMATIC STEP 7 Easy Motion Control ..................................................................71
2.7.6 SIMATIC STEP 7 PID Professional .......................................................................................71
[Link] Notes on SIMATIC STEP 7 PID Professional ........................................................................71
3 WinCC ........................................................................................................................................................73
3.1 Security information ...............................................................................................................73
3.2 Data protection.......................................................................................................................80
3.3 Notes on use ..........................................................................................................................81
3.4 Migration ................................................................................................................................83
3.5 Engineering System ...............................................................................................................84
3.5.1 Screens and Screen Objects .................................................................................................84
3.5.2 Tags and connections ............................................................................................................87
3.5.3 Alarm system and alarm displays ..........................................................................................88
3.5.4 System functions and scripts .................................................................................................89
3.5.5 Reports...................................................................................................................................91
3.5.6 Recipes ..................................................................................................................................91
3.5.7 User administration ................................................................................................................91
3.5.8 Communication ......................................................................................................................92
3.6 System-wide functions ...........................................................................................................96
3.7 Compiling and loading............................................................................................................97
3.8 Runtime..................................................................................................................................99
3.8.1 Notes on operation in Runtime...............................................................................................99
3.8.2 Notes on operation of panels in Runtime .............................................................................101
3.8.3 Notes on operation of Runtime Advanced ...........................................................................102
3.8.4 Notes on operation of Runtime Professional........................................................................103
3.8.5 Notes on operation of Runtime Unified ................................................................................108
[Link] General information..............................................................................................................108
[Link] Screens and screen objects.................................................................................................110
[Link] Alarm system and alarm display ..........................................................................................113
[Link] System functions and scripts ...............................................................................................113
[Link] Libraries ...............................................................................................................................114
[Link] Notes on operation of Runtime Unified ................................................................................114
[Link] Working with plant objects and plant views..........................................................................115
[Link] Internet browsers for WinCC Runtime Unified .....................................................................115
[Link] Activating and testing ASIA licenses....................................................................................117
[Link] Readme WinCC Plant Intelligence Options .........................................................................118
3.9 HMI devices .........................................................................................................................121
3.9.1 Notes on HMI devices ..........................................................................................................121
3.10 Add-ons................................................................................................................................126
3.10.1 Sm@rtServer .......................................................................................................................126

Readme
4 Programming and Operating Manual, 11/2019
 Table of contents

3.10.2 Audit .....................................................................................................................................126

3.10.3 DataMonitor..........................................................................................................................126
3.10.4 WebNavigator ......................................................................................................................127
3.10.5 WebUX.................................................................................................................................128
3.10.6 Redundancy .........................................................................................................................128
3.10.7 SIMATIC Information Server ................................................................................................129
4 Safety .......................................................................................................................................................131
4.1 Security information .............................................................................................................131
4.2 Notes on use ........................................................................................................................132
4.3 Editing devices and networks...............................................................................................133
4.3.1 General notes on devices and networks ..............................................................................133
4.4 Programming PLC................................................................................................................134
4.4.1 General Notes on PLC Programming and on Acceptance...................................................134
5 SIMATIC Energy Suite Readme...............................................................................................................137
5.1 Security information .............................................................................................................137
5.2 Data protection.....................................................................................................................138
5.3 What's new in SIMATIC Energy Suite V16? ........................................................................139
5.4 What's new in SIMATIC Energy Suite V15.1? .....................................................................141
5.5 What's new in SIMATIC Energy Suite V14 SP1?.................................................................142
5.6 Migration of a project from Energy Suite V14 SP1...............................................................144
5.7 Notes on use ........................................................................................................................145
6 TIA Portal Version Control Interface.........................................................................................................149
6.1 Security information .............................................................................................................149
6.2 Notes on use ........................................................................................................................150
Index.........................................................................................................................................................151

Readme
Programming and Operating Manual, 11/2019 5
Table of contents

Readme
6 Programming and Operating Manual, 11/2019
Notes on TIA Portal 1
1.1 General notes
The information in this readme file supersedes statements made in other documents.
Read the following notes carefully because they include important information for installation
and use. Read these notes prior to installation.

Information on TIA Portal in online support

Overview of the most important technical information and solutions for TIA Portal in the
Siemens Industry online support.
Internet link: TIA Portal in Siemens Industry online support (https://
[Link]/cs/ww/en/view/65601780)
All information on service and support in the Siemens Industry online support:
Internet link: Service and support in Siemens Industry online support (https://
[Link]/cs/de/en/)
Here, you can also subscribe to the newsletter that provides you with latest information relating
to your products.

Collection of diagnostic and feedback data

We collect and process statistical usage and diagnostic data, such as frequency of use of TIA
Portal editors or functions to keep the TIA Portal secure and up-to-date, to detect, diagnose and
remedy problems, and for product improvements.
The usage and diagnostic data is initially saved locally on your computer in readable format
where you can view it. Storage location: "...\ProgramData\Siemens\Automation
\TelemetryConnector". (Note: The Windows administrator can set the folder so that it is visible.)
In a second step, the usage and diagnostic data is transferred to Siemens via secure
communication for the purposes listed above.

Starting TIA Portal

When you start TIA Portal, Windows attempts to update the Certificate Revocation List (CRL)
of "[Link]".
If no Internet access is available and there are multiple DNS servers, a timeout might occur and
delay the start of TIA Portal.

Windows 7 / Windows Server 2008 R2: Invalid certificate validation

The new certificates used for signing might not be validated on the Windows 7 and Windows
Server 2008 R2 operating systems.

Readme
Programming and Operating Manual, 11/2019 7
Notes on TIA Portal
1.1 General notes

If you do not have the possibility to update the certificate store online, the signature of the
product files is displayed as invalid. In this case, update the root certificates provided by
Microsoft on the offline systems. To do so, follow the instructions in FAQ 109748887 (https://
[Link]/cs/ww/en/view/109748887).

Display of Asian characters in TIA Portal

Texts in TIA Portal might not display correctly if you install a Chinese TIA Portal on another
Asian operating system (for example, Korean). To view the texts in TIA Portal correctly, open
the Windows Control Panel and select "English" under "Language for non-Unicode programs".
Note, however, that this can cause display problems in other programs.

Installing new .Net versions or .Net service packs

● Close TIA Portal before installing a new .Net version or a new .Net service pack on your
programming device/PC.
● Restart TIA Portal only after successful installation of the new .Net version or the new .Net
service pack.

Operating TIA Portal

● If a project in the list of projects last used is located on a network drive that is not connected,
you might experience delays when opening the "Project" menu.
● When you insert a CPU, you might need to wait for some time if the project editor is open at
the same time. This generally takes longer when you insert the first CPU in a newly created
project. To be able to continue working at a good pace, you should close the project text
editor before inserting a CPU.
● The alarm "Application is not responding" might appear in Windows 7 with functions that
take a long time to run (loading the CPU for example). If this occurs, wait until the function
has correctly finished.
● If you have installed a Microsoft mouse with IntelliPoint, you might find that it superimposes
components over the buttons of the title bar. If this is the case, uninstall the IntelliPoint
software from Microsoft.
● Enabling the "Virtual Desktop" options with NVIDIA graphics cards can cause problems. In
this case, disable the "nView virtual desktop manager" of your NVIDIA graphics driver.

Working with automatically synchronized network drives

A TIA Portal project consists of multiple files that are saved together in one directory. If you
store a project that is automatically synchronized on a network drive or in a cloud directory (e.g.
Dropbox, Syncplicity or GoogleDrive), this can lead to data loss if the synchronization only
takes place partially or asynchronously. For this reason, we do not recommend editing TIA
Portal projects directly on synchronized network drives or in cloud directories. Always close TIA
Portal project before synchronization and make sure that all directories and files from the
project directory are synchronized together and completely. You might wish to disable
automatic synchronization while working with TIA Portal. The synchronization itself must be
implemented in such a way that the current (local) project data replaces the project data on the
network drive or in the cloud directory.

Readme
8 Programming and Operating Manual, 11/2019
 Notes on TIA Portal
1.1 General notes

Entry of decimal places

With certain Windows language settings, it might occur that the entry of values with a comma
as a decimal place is not recognized (entering "1,23" leads to an error). Instead, use the
international format ("1.23").

Opening projects with missing software components

If a project cannot be opened in TIA Portal due to missing software components, you can
download and install it as trial software from Siemens Industry online support. You can then
open the project. Note that the trial software can only be used for a limited period of time.
Use the following link to open the page in Siemens Industry online support, where the various
software products are available to you as trial software: [Link]/tia-portal-trial
([Link]/tia-portal-trial)

Readme
Programming and Operating Manual, 11/2019 9
Notes on TIA Portal
1.2 Notes on libraries

1.2 Notes on libraries

Contents
Information that could not be included in the online help and important information about
product characteristics.

Copying library elements

If master copies and types have the same name, the corresponding objects in the project are
overwritten when the action "Copy" is used. Note that this takes place without a prompt. The
same behavior occurs when the name of the master copy is different to the name of the type,
but an object within the master copy has the same name as the type.

Readme
10 Programming and Operating Manual, 11/2019
 Notes on TIA Portal
1.3 Notes on memory cards

1.3 Notes on memory cards

Contents
Information that could not be included in the online help and important information about
product characteristics.

SIMATIC memory cards

The SIMATIC memory cards have been formatted and set up by Siemens for use with S7-1200
and S7-1500 modules. This format must not be overwritten; otherwise, the card will no longer
be accepted by the modules. Formatting with Windows tools is therefore not permitted.

Behavior in case of open force job

Note that an active force job is retained even after you have loaded a new project to the
SIMATIC memory card. This means you should first delete the active force job before you
remove a SIMATIC memory card from the CPU and before you overwrite the card in the PC with
a new project. If you use a SIMATIC memory card with unknown content, you should format the
SIMATIC memory card before the next download.

Access protection for memory cards in USB card readers

By improving the security mechanisms for online access and engineering of S7-1500 CPUs,
the data storage on memory cards has been changed. For this reason, this version of STEP 7
cannot evaluate the passwords of the configured protection level when reading project data
from memory cards that is accessed via a USB card reader. The changed response affects the
memory cards for CPUs of the S7-1200/1500 series. Therefore, use physical safeguards to
protect critical project data on memory cards for these devices.

Note
This restriction is not related to online access to devices or the know-how protection of program
blocks.

Removing/inserting the memory card

After removing or inserting a memory card, always perform a memory reset on the CPU in order
to restore the CPU to a functional condition.

Readme
Programming and Operating Manual, 11/2019 11
Notes on TIA Portal
1.4 Notes on using TIA Portal in a virtual environment (private cloud)

1.4 Notes on using TIA Portal in a virtual environment (private cloud)

Contents
Information that could not be included in the online help and important information about
product characteristics.

Instructions for using TIA Portal in a virtual environment (private cloud)

You can find instructions on how to use TIA Portal in a virtual environment (private cloud) on the
installation disk in the directory "Documents\Readme\<language directory>". You can open the
PDF document "TIAPortalCloudConnectorHowTo<language ID>.pdf" here.
The TIA Portal Cloud Connector can be used with the Windows 7 (64-bit) and Windows 10 (64-
bit) operating systems.

Environment variables "TiaUserSettingsPath" and "TiaDefaultProjectPath"

The environment variables "TiaUserSettingsPath" and "TiaDefaultProjectPath" can be used to
set the location of the user and project settings different from the system default. This can be
used, for example, to save the user and project settings at a central location.
You can find additional information on the use of environment variables in the Instructions on
Using TIA Portal in a Virtual Environment (Private Cloud).

Self-signed certificates using HTTPS as communication protocol

Microsoft regularly checks whether the certificates in the Windows Certificate Store are from a
trusted source. Certificates from untrusted sources are deleted. Therefore, ensure that your
self-signed certificates are signed with a secure certificate.

Readme
12 Programming and Operating Manual, 11/2019
 Notes on TIA Portal
1.5 Notes on using the TIA Portal Teamcenter Gateway

1.5 Notes on using the TIA Portal Teamcenter Gateway

Contents
Information that could not be included in the online help and important information about
product characteristics.

Installing the TIA Portal Teamcenter Gateway

You can find instructions for installing the TIA Portal Teamcenter Gateway in the TIA Portal
Teamcenter Gateway online help under "Installing and uninstalling TIA Portal Teamcenter
Gateway".

Using the TIA Portal Teamcenter Gateway

The installation of the TIA Portal Teamcenter Gateway gives you access to the TIA Portal
Teamcenter Gateway function that is available as of TIA Portal V14 and higher.

Installing the TIA Portal Teamcenter Gateway - data model

You can find a description for installing the TIA Portal Teamcenter Gateway data model on the
installation data medium in the directory "\Support\Teamcenter_11\ServerSetupDocument\"
on the STEP 7/WinCC DVD2. Open the PDF document "Datamodel_Installation_enUS". The
instructions for installing the TIA Portal Teamcenter Gateway data model are only available in
English.

Updating the existing TIA Portal Teamcenter Gateway data model

● Restart TIA Portal after updating the existing TIA Portal Teamcenter Gateway data model.
● In the TIA Portal Teamcenter Gateway V15 and V15.1, no changes were made to the
existing TIA Portal Teamcenter Gateway data model and no changes specific to the
Teamcenter as well.

Notes on Teamcenter
To work with the TIA Portal Teamcenter Gateway, Teamcenter Rich Application Client (RAC)
or Teamcenter Client Communication System (TCCS) as of version 11.2 must be installed on
your PG/PC.

Note on TCCS (Teamcenter Client Communication System)

If you have completed the installation of TCCS (Teamcenter Client Communication System) as
a "standalone" installation, you also need to install "Microsoft Visual C++ 2013 –
Redistributable".

Readme
Programming and Operating Manual, 11/2019 13
Notes on TIA Portal
1.5 Notes on using the TIA Portal Teamcenter Gateway

Note on UTF-8
In order to display data from Teamcenter with non-English character sets, e.g. for Asian
languages, in TIA Portal, Unicode character sets need to be used.

Note on cloud computing

If you run TIA Portal in a Cloud (for example virtual machine), this system has to be integrated
into the Teamcenter environment. Direct integration via a remote connection is not supported
by TIA Portal Teamcenter Gateway.

Basic information on working with TIA Portal Teamcenter Gateway

As of TIA Portal Teamcenter Gateway version V15, the Teamcenter operation "Teamcenter >
Export..." is available for TIA Portal projects and global libraries.
With this operation, you create a copy of the current project, which is completely free of any
Teamcenter information. If you need to separated from Teamcenter, use this operation instead
of the "Save as" operation because "Save as" retains Teamcenter information in the project.

Connecting to Teamcenter
As of TIA Portal Teamcenter Gateway V15.1 Update 3, you can establish a connection
between TIA Portal and Teamcenter both via HTTP and via HTTPS.

Teamcenter version information

To work with the TIA Portal Teamcenter Gateway version V15.1 or the TIA Portal Teamcenter
Gateway version V16 and Teamcenter version V11.6, you need to have Teamcenter
version V11.6.0.5 or higher installed. As of Teamcenter version V11.6.0.5, improvements have
been which allow it to work smoothly with Teamcenter version V11.6.
As of the TIA Portal Teamcenter Gateway version V16, working with the Teamcenter version
V12.[Link] is supported.

Setting the TIA Portal Teamcenter Gateway cache path

By default, the value entered under "Options > Settings > General > Teamcenter Gateway" in
the "TIA Portal Teamcenter Gateway Cache Path" area is taken as "TIA Portal Teamcenter
Gateway Cache Path".
By default, this value refers to the project directory path.
If you change the value of the "TIA Portal Teamcenter Gateway Cache Path", Teamcenter
Gateway checks the validity of the values entered by default and the changed values.

Note
The default value must not be empty.

Readme
14 Programming and Operating Manual, 11/2019
 Notes on TIA Portal
1.5 Notes on using the TIA Portal Teamcenter Gateway

Performing TIA Portal Teamcenter Gateway operations while WinCC Professional Simulation is running
Do not perform Teamcenter Gateway operations, such as "Check in" or "Undo check out"
during a started WinCC Professional Simulation.

Readme
Programming and Operating Manual, 11/2019 15
Notes on TIA Portal
1.6 Information on working with Multiuser Engineering

1.6 Information on working with Multiuser Engineering

Contents
Information that could not be included in the online help and important information about
product features of Multiuser Engineering and about the project server.
The installation of the project server allows you to use the "Multiuser Engineering", "Multiuser
Commissioning" and "Exclusive Engineering" functions available with the corresponding TIA
Portal.

Name changes
In TIA Portal version V16 the following name changes were made in the context of Multiuser
Engineering :

Previous name New name in TIA Portal V16 and higher

Multiuser server TIA project server
Local Multiuser server Local project server
Multiuser server project Server project
Multiuser network profiles Network profiles

The project server can be used for Multiuser Engineering, and also for Multiuser
Commissioning and Exclusive Engineering .
There are no functionality restrictions between the project server V16 and the Multiuser server
V15.1.
The functionality of the server remains unchanged depending on the version.
The project server V16 is backward compatible with the Multiuser server V14.

Microsoft system account for project server

When the project server is installed, a Microsoft system account is created for the project
server. Microsoft changes the password cyclically for this account.
If the password for this account has expired, the password needs to be changed and then the
project server needs to be restarted.

Readme
16 Programming and Operating Manual, 11/2019
 Notes on TIA Portal
1.6 Information on working with Multiuser Engineering

Error message when starting the project server

If you get an error message during or after installing the project server stating that the service
for the project server cannot be started, the following procedure is recommended:
1. Open the Windows event view and check whether an error entry with the error number
"1069" is present.
2. If this is the case, information on how to proceed is provided below.
Internet link: TIA Portal in Siemens Industry online support (https://
[Link]/cs/ww/en/view/65601780)
3. Alternatively, you can contact Customer Support directly.
Internet link to Customer Support: FAQ with ID 109739926 (https://
[Link]/cs/ww/en/view/109739926)

Working with active monitoring jobs and forcing jobs in the local session
Active monitoring jobs and forcing jobs must be closed before a check-in or update in the local
session. It is not possible to check in or update in the local session while monitoring or forcing
jobs are active.

Working in the local session with the "Keep local session" option
If the "Keep local session" option is selected after the check-in, all checked-in objects in the
local session appear as outdated, even if their content is identical.

Working with different versions of TIA Portal

Local sessions created with <x.y> version of TIA Portal can only be worked on with this version.
Example: A local session created with TIA Portal V16 as part of a V16 project cannot be edited
with an earlier version of TIA Portal.

Working with Multiuser Commissioning

● When you work with Multiuser Commissioning, a new revision of the server project is
created after each download to the CPU. However, a new revision is not created when
objects that cannot be marked were edited in the local session. Changes to objects that
cannot be marked are lost during check-in and are not downloaded to the CPU.
● When you start download to the device in Commissioning mode from the project tree with
the menu command "Download to device > Hardware configuration", the dialog which
informs you that different data exists on the CPU and in the server project is always
displayed.
● When you work in Commissioning mode, only S7-1500 CPUs are fully supported. When
using an S7-300/400 CPU, the dialog which informs you that different data exists on the
CPU and in the server project is always displayed in Commissioning mode. The reason is
that S7-300/400 CPUs do not support synchronization. To prevent this message from being
displayed, you should disable the option "Check for data mismatch before loading
(recommended)" in the Administration tool.

Readme
Programming and Operating Manual, 11/2019 17
Notes on TIA Portal
1.6 Information on working with Multiuser Engineering

See also
TIA Portal in Siemens Industry online support ([Link]
view/65601780)
FAQ with ID 109739926 ([Link]

Readme
18 Programming and Operating Manual, 11/2019
STEP 7 2
2.1 Security information

Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
security concept. Siemens’ products and solutions only form one element of such a concept.
Customer is responsible to prevent unauthorized access to its plants, systems, machines and
networks. Systems, machines and components should only be connected to the enterprise
network or the internet if and to the extent necessary and with appropriate security measures
(e.g. use of firewalls and network segmentation) in place.
Additionally, Siemens’ guidance on appropriate security measures should be taken into
account. For more information about industrial security, please visit
[Link] ([Link]
company/topic-areas/future-of-manufacturing/[Link])
Siemens’ products and solutions undergo continuous development to make them more secure.
Siemens strongly recommends to apply product updates as soon as available and to always
use the latest product versions. Use of product versions that are no longer supported, and
failure to apply latest updates may increase customer’s exposure to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS
Feed under
[Link] ([Link]
company/topic-areas/future-of-manufacturing/[Link])

Network settings
The following tables show the network settings of each product you need to analyze the
network security and to configure external firewalls:

STEP 7 Professional
Name Port number Transport Direction Function Description
protocol
ALM 4410* TCP Inbound/ License serv‐ This service provides the complete function‐
outbound ice ality for software licenses and is used by
both the Automation License Manager as
well as all license-related software products.
RFC 1006 102 TCP Outbound S7 communi‐ Communication to the S7 controller via
cation Ethernet/PROFINET for programming and
diagnostic purposes.

Readme
Programming and Operating Manual, 11/2019 19
STEP 7
2.1 Security information

STEP 7 Professional
DCP --- Ethernet Outbound PROFINET The DCP protocol (Discovery and Basic
Configuration Protocol) is used by PROFI‐
NET and provides the basic functionality for
locating and configuring PROFINET devi‐
ces.
SNMP 161 UDP Outbound PROFINET The SNMP client functionality is used by
STEP 7 to read status information from
PROFINET devices.
* Default port that can be changed by user configuration

WinCC ES Basic (without simulation)

Name Port number Transport pro‐ Direction Function Description
tocol
ALM 4410* TCP Inbound/ License serv‐ This service provides the complete function‐
outbound ice ality for software licenses and is used by
both the Automation License Manager as
well as all license-related software products.
HMI Load 1033 TCP Outbound HMI Load (RT This service is used to transmit images and
Basic) configuration data to Basic Panels.
* Default port that can be changed by user configuration

Simulation RT Basic
Name Port number Transport pro‐ Direction Function Description
tocol
HMI Load 1033 TCP Inbound HMI Load (RT This service is used to transmit images and
Basic) configuration data to Basic Panels.
Ethernet/I 44818 TCP Outbound Ethernet/IP The Ethernet/IP protocol is used for connec‐
P channel tions to Allen Bradley PLCs.
2222 UDP Inbound Ethernet/IP The Ethernet/IP protocol is used for connec‐
channel tions to Allen Bradley PLCs.
Modbus 502 TCP Outbound Modbus TCP The Modbus TCP protocol is used for con‐
TCP channel nections to Schneider PLCs.
RFC 1006 102 TCP Outbound S7 channel Communication to the S7 controller via
Ethernet/PROFINET
Mitsubishi 5002 TCP Outbound Mitsubishi MC The Mitsubishi protocol is used for connec‐
MC channel tions to Mitsubishi PLCs.

Readme
20 Programming and Operating Manual, 11/2019
 STEP 7
2.2 Notes on use

2.2 Notes on use

Contents
Information that could not be included in the online help and important information about
product characteristics.

Compatibility after upgrading a project to V16

After upgrading a project to V16, online/offline differences might be indicated although the
online and offline programs are identical. These differences are due to optimization of the
calculation of checksums in V16. But the blocks are still compatible in most cases.
In some rare cases, however, you might have to recompile and download the project again due
to the changes in the checksum calculation before you can monitor and test the project online.
You can find more information in the log files for upgrading in the project properties. If a
checksum inconsistency is reported in the log files, then the online/offline differences are due
to the changed checksum calculation.
Further information can be found in the section "Online connection after upgrading a project".

Parallel use
If the term "Combo" appears in the name or license key of the software after installation, the use
of the following products/versions is permitted in accordance with Article 1.6 of the General
Terms and Conditions (see also setup text):
● STEP 7 Professional 2017
● STEP 7 Professional 2010
● STEP 7 Professional 2006

Removing and inserting Ethernet modules

If Ethernet modules are removed and re-inserted during operation, you must boot the PC;
otherwise, the "Accessible devices" functionality in STEP 7 or NCM PC will not display all
devices. While the PC boots, Ethernet modules must be activated.

Compatibility (S7-1200)
The device configuration and program of an S7-1200 CPU must always be configured with the
same STEP 7 version. Usually, TIA Portal makes sure that no version conflicts occur by
outputting appropriate notifications during loading to the device.
This automatic verification is not possible with S7-1200 CPUs with firmware version V1.x. In
this case, users themselves must ensure that no version conflicts occur.

Readme
Programming and Operating Manual, 11/2019 21
STEP 7
2.3 Simultaneous online operation

2.3 Simultaneous online operation

Contents
Information that could not be included in the online help and important information about
product characteristics.

Simultaneous online operation

The simultaneous online operation of STEP 7 V5.6 or earlier and STEP 7 V16 (TIA Portal) has
not been approved.

Simultaneous online connections on an S7-1200 CPU (S7-1200)

It is not possible to establish an online connection from multiple instances of TIA Portal
simultaneously to the same S7-1200 CPU.

Readme
22 Programming and Operating Manual, 11/2019
 STEP 7
2.4 Editing devices and networks

2.4 Editing devices and networks

2.4.1 General information on devices and networks

Contents
Information that could not be included in the online help and important information about
product characteristics.

S7-PCT IO-Link (S7-1200)

The S7 Port Configuration Tool is available for free download at the following link.
[Link] (https://
[Link]/cs/ww/en/view/32469496)

Port Configuration Tool PCT

If you use the PCT tool, make sure that you always use the current version that is available free
of charge with the following link:
[Link] (http://
[Link]/WW/view/en/32469496)

2.4.2 Notes on the hardware configuration

Contents
Information that could not be included in the online help and important information about
product characteristics.

Editing a device IP address

Do not use the address range from 192.168.x.241 to 192.168.x.250 when editing a device IP
address. If necessary, this address range is automatically assigned by the system to a
programming device. Depending on the subnet mask, this applies also for all network classes.

2.4.3 Information about OPC UA functions

Contents
Information that could not be included in the online help and important information about
product characteristics.

Readme
Programming and Operating Manual, 11/2019 23
STEP 7
2.4 Editing devices and networks

Schema files used for OPC UA functionality

The OPC Foundation provides its members with schemes that manufacturers can use for their
respective server/client implementations. These files are used, for example, to validate
imported information models / node sets.
The following schema and nodeset files are used for TIA Portal version V16 or S7-1500 CPU
firmware version V2.8:

Schema/Nodeset Explanation
[Link] XML scheme for NodeSet data
(2018-12-04)
[Link] OPC UA ("CORE") Model Version 1.04
(2018-06-04)
[Link] OPC UA for Devices ("DI") Model Ver‐
sion 1.01 (2018-06-06)

PLC object not visible in the server address space

With very large projects, it can happen in rare cases that, despite successful compiling of the
project and successful downloading to the CPU, the CPU node or PLC object is not visible in
the address space of the OPC UA server. In this case the memory reserved for OPC UA in the
CPU is insufficient.
Diagnostics, e.g. using UaExpert, returns the "Failed" server status.

Remedy
Disable the standard SIMATIC server interface in the CPU properties if it is not required.
Reduce the quantity or size of the elements that contribute towards the consumption of OPC
UA resources. Reduce the number of nodes for server interfaces to fewer than 30000.
Additional measures:
● Reduce the number of tags in the address space of the OPC UA server, in particular of tags
with the data type structure.
To remove tags from the address space, disable the option "Accessible from HMI/OPC UA"
in the PLC tag table or in the data blocks.
With data blocks, you also have the possibility to remove the DB with all tags completely
from the address space. To do this, disable the option "DB accessible from OPC UA" in the
properties of the DB.
● Reduce the length of names of the elements in extensive data structures.
● Shorten the descriptions of the nodes.
● Reduce the number of implemented methods.

OPC UA client-server connection via NAT router

If client and server are connected via NAT routers, this attempt to make a connection fails with
the error message "BadCommunicationError" or "BadNotConnected".
Background: The IPv4 packets are manipulated by the router in NAT systems. As a result,
either the source IP ("Source NAT") or the destination IP ("Destination NAT") of a packet is

Readme
24 Programming and Operating Manual, 11/2019
 STEP 7
2.4 Editing devices and networks

replaced by an IP address configured in the router (depending on the destination port). This
process is transparent for client and server, i.e. these devices are not informed about this
process.
The problem: The NAT router also has no way to replace the endpoint description returned by
the server (this is the EndpointUrl), since this address information is located in the user data of
"GetEndpointsResponse".
You can find a detailed description of the procedure in the following FAQ (https://
[Link]/cs/ww/en/view/109766709).

CPU firmware version V2.6

No OPC UA client-server connection via NAT router possible.

Remedy as of CPU firmware version V2.8

Use the "ServerUri" attribute of the connection information ("SessionConnectInfo" parameter
of the "OPC_UA_Connect" instruction).
Enter the complete ServerEndpointUrl with the IP address of the NAT router as "ServerUri".
This ServerEndpointUrl is then used to establish the connection instead of the EndpointUrl
returned in GetEndpointsResponse.
If you leave the attribute empty, the behavior will be the same as in CPU firmware version V2.6.
When you use the connection parameter assignment for the OPC UA connection setup (create
client interface), then you must open the client interface DB (*_Configuration[DBx]) after the
parameter assignment and change the string in the "ServerUri" parameter. The entry is
retained after compiling the OPC UA configuration.

Example of establishing a connection (address from ServerUri replaces address from

GetEndpointsResponse)
Procedure: In the "ServerUri" parameter, enter the complete server address
(ServerEndpointUrl), consisting of IP address, port and optional path. The IP address is the
client-side IP address of the NAT router:
1) Open configuration DB

2) Change "ServerUri" parameter

Readme
Programming and Operating Manual, 11/2019 25
STEP 7
2.4 Editing devices and networks

The connection is then established with the following steps:

● GetEndpointsRequest: The S7-1500 OPC UA client addresses the server via the
destination address of the NAT router in the client subnet ([Link]).
The NAT router converts the destination address into the IP address of the server
([Link]) in the subnet of the server.
● GetEndpointsResponse: The server returns its EndpointUrl in "GetEndpointsResponse":
"[Link]://[Link]:4840/UA/DemoServer".
This address cannot be reached directly by the client because it is located behind a NAT
router.
● OpenSecureChannel:
The client does not take the EndpointUrl from the GetEndpointsResponse to open the
secure channel. Instead, it takes the EndpointUrl from the "ServerUri" parameter:
"[Link]://[Link]:4840/UA/DemoServer".
This IP address can be reached by the client; the data is routed from the NAT router to the
IP address of the server.

Restart of the OPC UA server

The OPC UA server of an S7-1500 CPU from firmware version V2.8 is only stopped when
loading data relevant for OPC UA into the CPU (e.g. overwriting a data block). The server then
restarts if you have allowed the loading process.
Please note that OPC UA clients cannot continue to use the running services for this server in
this case and that the resources therefore need to be released again.
These services need to be requested again:
● Re-initiate connection setup
● Regenerate subscriptions
● Recreate read/write jobs
In many cases, e.g. after adding new code blocks or new data blocks that are not OPC UA-
relevant, the server is no longer stopped.

Mapping of CPU data types to OPC UA data types for S7-1200 CPUs
S7-1200 CPUs as of firmware version V4.4 have an OPC UA server. You can configure OPC
UA server interfaces for this server.

Readme
26 Programming and Operating Manual, 11/2019
 STEP 7
2.4 Editing devices and networks

The following mapping of the S7-1200 data types to OPC UA data types applies:

SIMATIC data type OPC UA data type

BOOL Boolean
SINT SByte
USINT Byte
INT Int16
UINT UInt16
DINT Int32
UDINT UInt32
REAL Float
LREAL Double
WSTRING String
(UCS-2; Universal Coded Character Set)
DWORD StatusCode

The OPC UA server of the S7-1200 supports reading and writing of the listed simple data types.
The following data types are not supported:
● Structures
● Arrays
● Unions
Although tags with these data types can be loaded (no message from consistency check), client
access to these tags is rejected during runtime with an error message.
Methods cannot be programmed either.

Additional status codes for OPC UA client instructions

Due to the changed behavior for releasing connection handles on S7-1500 CPUs as of
firmware V2.8, there are additional error codes that are not documented with all of these
instructions.

Readme
Programming and Operating Manual, 11/2019 27
STEP 7
2.4 Editing devices and networks

The following table lists these error codes with explanations.

Error code Name of the error Explanation

(hexadecimal values)
80AE_0000 BadConnectionClosed The connection with the corre‐
sponding ConnectionHdl has
the "ShutDown" status (connec‐
tion terminated). The connec‐
tion/session could not be "reac‐
tivated" automatically. Possible
cause: Session deleted on the
server, e.g. due to restart or
timeout.
In this case, you must explicitly
close the connection with the
instruction "OPC_UA_Discon‐
nect" and thereby release the
connection resources again. In
your user program, you must
reset the ConnectionHdl for this
connection which has become
invalid.
Then you have to establish a
new connection to the server
(see instruction
"OPC_UA_Connect").
The error code can occur with
all client instructions except the
OPC_UA_Connect,
OPC_UA_Disconnect, and
OPC_UA_ConnectionGetSta‐
tus instructions.
80AF_0000 BadInvalidState The connection with the corre‐
sponding ConnectionHdl has
the "ConnectionError" status
(temporary connection error,
connection interrupted). The
CPU tries to "reactivate" the
connection. If this does not suc‐
ceed within the set timeout in‐
terval (OPC UA Session Time‐
out), the connection goes into
the "Shutdown" state. Require‐
ments for the state transition:
The CPU was able to reach the
OPC UA server to check wheth‐
er or not the session is still ac‐
tive.
The error code can occur with
all client instructions except the
OPC_UA_Connect,
OPC_UA_Disconnect, and
OPC_UA_ConnectionGetSta‐
tus instructions.

Readme
28 Programming and Operating Manual, 11/2019
 STEP 7
2.4 Editing devices and networks

Error code Name of the error Explanation

(hexadecimal values)
A000_0105 PLCopenUA_Bad_ConnectionInvalidHdl The connection handle (Con‐
nectionHdl) is invalid / un‐
known.
The error code can occur with
all client instructions except the
OPC_UA_Connect instruction.

Copying SCL program examples from the information system

SCL program code from the OPC UA programming examples, which was copied using the
"Copy" icon in the information system and pasted in the program editor, cannot be compiled.
To copy the program code without errors, select the program code in the information system
and use the "Copy" command in the shortcut menu or the key combination "Ctrl+C". Insert the
program code in the program editor using the "Paste" command in the shortcut menu or using
the key combination "Ctrl+V".

2.4.4 Hardware detection of IO devices

Contents
Information that could not be included in the online help and important information about
product characteristics.

Incomplete hardware recognition at ET 200SP stations

With STEP 7 V15 you can use the online function "Hardware detection" to determine the station
configuration of IO devices and to import them in your project including all plugged modules.
If you import an ET 200SP via the hardware detection in your project, you have to complete the
determined station configuration manually yourself: Check at the interface module whether the
suitable bus adapter was determined in the hardware configuration (for example BA 2xRJ45
instead on the BA 2xFC really present).

2.4.5 HW ID of type "Hw_SubModule" for an HMI Panel IO device

Contents
Information that could not be included in the online help and important information about
product characteristics.

Readme
Programming and Operating Manual, 11/2019 29
STEP 7
2.4 Editing devices and networks

Determination of the HW ID with the "Hw_SubModule" type for an HMI Panel IO device
The "ID" parameter of the PROFIenergy "PE_START_END" program block must be supplied
with the hardware identifier (HW ID) with the type "Hw_SubModule" of the IO device. The
hardware ID with the "Hw_SubModule" type of the HMI Panel IO device is not displayed in the
system constants on an S7-1500/S7-1200/ET200SP CPU, but it can be determined. To do this,
the symbol for the IO device in the HMI panel with the type "Hw_Device" is determined in the
list of PLC tags in the "System constants" tab and reduced by one, for example,
"HMI_1_IE_CP_1~PROFINET_Interface_1~IODevice -1".

2.4.6 Use of modules on the S7-1200

Content
Information that could not be included in the online help and important information about
product characteristics.

Use of modules on the S7-1200

The modules listed below are not supported on the S7-1200.

Family Module Order number

S7-300 FMs SM 338 6ES7 338-4BC01-0AB0
FM 350-1 6ES7 350-1AH03-0AE0
FM 350-2 6ES7 350-2AH00-0AE0, 6ES7 350-2AH01-0AE0
FM 351 6ES7 351-1AH01-0AE0, 6ES7 351-1AH02-0AE0
FM 352 6ES7 352-1AH02-0AE0
FM 355 S 6ES7 355-1VH10-0AE0
FM 355 C 6ES7 355-0VH10-0AE0
FM 355-2 C 6ES7 355-2CH00-0AE0
FM 355-2 S 6ES7 355-2SH00-0AE0
S7-300 PtP-CP CP 340 6ES7 340-1AH02-0AE0, 6ES7 340-1BH02-0AE0, 6ES7
340-1CH02-0AE0
CP 341 6ES7 341-1AH01-0AE0, 6ES7 341-1AH02-0AE0, 6ES7
341-1BH01-0AE0, 6ES7 341-1BH02-0AE0, 6ES7
341-1CH01-0AE0, 6ES7 341-1CH02-0AE0
Network component Diagnostics repeater 6ES7 972-0AB01-0XA0
ET 200M SIWAREX 7MH4900-2AA01, 7MH4900-3AA01, 7MH4950-1AA01,
7MH4950-2AA01

Loading S7-1200 module comments to the PG/PC

In central configurations with S7-1200, comments of modules, submodules and signal boards
are not loaded. With CPs/CMs, only the comments of the IE interface or DP interface are
loaded. In distributed configurations with ET 200SP or ET 200MP, only the comment of the
channels is loaded from the I/O modules.

Readme
30 Programming and Operating Manual, 11/2019
 STEP 7
2.4 Editing devices and networks

2.4.7 CP 343-2 on SIMATIC S7 Embedded Controller EC31-RTX

Contents
Information that could not be included in the online help and important information about
product characteristics.

CP 343-2 on SIMATIC S7 Embedded Controller EC31-RTX

The module AS-Interface CP 343-2 (article no.: 6GK7 343-2AH01) can be inserted in an
expansion rack of the SIMATIC S7 Embedded Controller EC31-RTX (article no.: 6ES7
677-1DDxx-0BB0), but the CP 343-2 cannot be operated with the EC31-RTX.

2.4.8 Loading of S7-1500 CPUs (SIPLUS)

Contents
Information that could no longer be included in the online help and important information about
product features.

Behavior of a SIMATIC S7-1500 CPU SIPLUS (6AG1...) FW <V2.5 with formatted memory card
Components involved:
● CPU 151x SIPLUS (6AG1...) with firmware version prior to V2.5
● SIMATIC memory card
If you load a SIPLUS CPU to a formatted SIMATIC memory card and then set the CPU to RUN,
the CPU runs without errors. But once the power supply has been switched off and on again or
if a memory reset (MRES) has been performed, the SIPLUS CPU goes into STOP with an error
message. The error message states that the memory card is not recognized because it is
missing, is of an incorrect type, contains incorrect data or is protected.
This behavior does not occur with a CPU 151x SIPLUS (6AG1...) with firmware version V2.5 or
higher or if a configuration with a S7-1500 SIMATIC CPU (6ES7...) already exists on the
memory card and is overwritten by a configuration with a SIPLUS CPU (6AG1...) of the same
type.
Remedy:
1. A configuration with SIMATIC CPU must be loaded on the SIMATIC memory card. Only a
CPU of the corresponding type must be available; the I/O is not required in this case.
2. The SIPLUS CPU is loaded to the card. The existing SIMATIC configuration on the memory
card is overwritten with the SIPLUS configuration.

Readme
Programming and Operating Manual, 11/2019 31
STEP 7
2.4 Editing devices and networks

This procedure prevents an error message of the TIA Portal.

Note
The procedure ONLY works for online loading to the CPU. The error remains if the card is
programmed by means of an external card reader.

If you want to load a CPU 1511-1 PN SIPLUS (6AG1 511-1AK00...), for example, do the
following.
1. Insert a blank memory card with sufficient available memory into the SIPLUS CPU.
2. Configure a SIMATIC CPU of the same type, here an S7-1511-1 PN (6ES7 511-1AK00...).
I/O modules are not required for the first load step.
3. Load the configuration onto the SIPLUS CPU.
4. Replace the SIMATIC CPU in STEP 7 with the SIPLUS CPU (6AG1 511-1AK00...) and
complete the configuration with the planned I/O modules and distributed I/O devices.
5. Load the changed configuration onto the SIPLUS CPU.

2.4.9 ET 200MP (IM 155-5 DP ST) on a WinLC RTX

Contents
Information that could not be included in the online help and important information about
product characteristics.

ET 200MP (IM 155-5 DP ST) can currently not be operated on a WinLC RTX via PROFIBUS.
Components involved:
● PC systems with logic controller functionality WinLC RTX as DP master (all versions: EC31-
RTX (F), WinAC RTX (F) software PLC), referred to as "WinLC RTX" below.
● ET 200MP (IM 155-5 DP ST) as DP slave
If you configure standard modules or F-modules in an ET 200MP and use a WinLC RTX as DP
master, these modules are not configured by the DP master in the ET 200MP. After loading the
configuration and startup of the components involved, the modules in the ET 200MP signal the
missing parameter assignment by means of flashing green LEDs.
STEP 7 does not show the readiness for operation of the modules online (status "OK").
Remedy:
● Recommendation: Use an IM 155-5 PN interface module to connect the ET 200MP to a
WinLC RTX via PROFINET IO.
or
● If no F-modules are inserted in the ET 200MP: Use the GSD version of the ET 200MP on an
WinLC RTX to configure the standard modules.

Readme
32 Programming and Operating Manual, 11/2019
 STEP 7
2.4 Editing devices and networks

2.4.10 Notes on online and diagnostics

Contents
Information that could not be included in the online help and important information about
product characteristics.

Hardware detection followed by online connection

When the "Online > Hardware detection" command is performed for an unspecified CPU, the
online configuration is not loaded from the CPU. If you do not load the configuration resulting
from the hardware detection to the CPU, the device and network views will always show a
difference between the offline and online configurations. It will appear that there are different
configurations in the online and diagnostic views, although the MLFBs are identical in the actual
CPU and the offline CPU.

Deleting measurements in the device (memory card) (S7-1200)

Do not delete any measurements in the device as long as a trace in the device still generates
new measurements on the memory card.

Project trace for Software Controller and Open Controller

With TIA Portal V16, project trace does not support the Software Controller or the Open
Controller.

2.4.11 Network components

[Link] Network and communication modules

Online connections for special diagnostics and firmware loader

Special diagnostics: Establishing an online connection

Some network components (S7-300/400 CPs, PC CPs, gateways) provide expanded
diagnostics data in special diagnostics.
Requirement:
A PG/PC interface is physically connected to the destination device, e.g. via an Ethernet cable.
Procedure:

Readme
Programming and Operating Manual, 11/2019 33
STEP 7
2.4 Editing devices and networks

Follow the steps outlined below to start special diagnostics:

1. Open the online and diagnostics view of the module.
2. In the "Functions" folder, select the group "Special diagnostics".
3. In the "Special diagnostics" area, click the "Start special diagnostics" button.
As of STEP 7 Professional V14 for several CPs only one online connection can be established
from the engineering station via the CP. This connection can be established either with STEP 7
or special diagnostics.
If special diagnostics is not started by the steps listed above and an error message is output
follow the steps below:
1. Disconnect the existing online connection to the station.
2. Open the online and diagnostics view of the module again as described above and start
special diagnostics.
32-bit applications; NCM S7 diagnostics, firmware loader
If you have established a connection to a PC CP from a 32-bit application and want to establish
another online connection via the same interface of the PC CP, you must first terminate the
connection of the 32-bit application.

Special diagnostics and firmware loader: Chinese GUI

When you open the special diagnostics or the firmware loader with a Chinese GUI, you need
to set the language for non-Unicode applications in the operating system to Chinese.

S7-CM/CP

No S7 routing with CP 300/400 < V3 as router

With S7 routing between S7‑1200 or S7‑1500 stations, no connection is established when older
S7‑300/400 CPs are connected in between as routers. The following types of communication
that run over ISO transport or ISO-on-TCP connections are affected:
● S7 communication
● PG communication
● HMI communication
The behavior applies to S7‑300/400 CPs with a firmware version < V3.0 for which the TSAP
length is limited to 2 bytes.
In contrast, like the S7‑1200/1500, S7‑300/400 CPs as of V3.0 support long TSAPs and thus
also S7 routing.

CM 1542‑1: Remove retentive storage of the IP address if there are duplicate addresses
The IP address and the device name of the CM 1542-1 remain installed retentively:

Readme
34 Programming and Operating Manual, 11/2019
 STEP 7
2.4 Editing devices and networks

If, for example during startup, the CM detects a duplicate address in another network, the CM
is not connected to the network. The CM changes to RUN and cannot be reached via the
Ethernet interface.
To be able to connect the CM to the network, you can remove the retentively stored IP address
as follows:
1. Remove the memory card of the CPU.
2. Using DCP with the Primary Setup Tool (PST) and with the CPU in STOP, set the IP address
of the CM to [Link] without configuration.
You have removed the retentively stored IP address of the CM. The CM can be connected
into the network.
3. Insert the memory card in the CPU again.

PC CPs and applications

PC CPs for VMware vSphere Hypervisor ESXi

The following communications processors have been released for operation with VMware
vSphere Hypervisor ESXi for STEP 7 Professional V14:
● CP 5711
● VMware E1000 network adapter
The following communications processors have not been released for operation with VMware
vSphere Hypervisor ESXi:
● CP 5611
● CP 5612
● CP 5621
● CP 5622
● CP 5512
Other communications processors such as the CP 1623 and CP 1628 are released following
installation of the SIMATIC NET PC software. You will find information on this in the readme file
of the SIMATIC NET PC software.

Download to PC stations
If you download project data to a PC station with PC-CP, make sure that the CP is available.
In the "Extended download to device" dialog, do not enable the check box for the search for
compatible nodes.
If you want to download to a different CP from the one selected earlier in the project, change the
IP address of the CP manually in the "Extended download to device" dialog in the list of
configured access nodes.

Readme
Programming and Operating Manual, 11/2019 35
STEP 7
2.4 Editing devices and networks

PROFIBUS S7 connections with OPC servers

The configuration of an S7 connection via PROFIBUS is not possible between an OPC server
as of V12 and an S7‑1200 as of V4 or an S7‑1500.
Remedy: Use an OPC server / PC application < V12 or use an S7‑1200 < V4 or an S7‑300 or
S7‑400 as the S7 station.

Visibility of PLC tags for OPC UA communication

If in the S7 communication between a PC station and an S7 station you configure PLC tags with
the option "Reachability from HMI/OPC UA" deactivated, this does not affect the visibility in the
OPC UA server of the PC station.

Access rights of an OPC client for access to PLC tags

If you want to write PLC tags of S7 stations that are provided via S7 communication in the OPC
UA server of a PC station from an OPC client, make sure that the following settings are made
in the configuration of the tags:
● The option "Can be written from HMI/OPC UA" is activated for the PLC tags.
● The access right "Read/Write" is activated in the symbol configuration of the OPC UA server
application of the PC station.

Security modules

Migration of projects with Ethernet CPs and activated security functions

In STEP 7 V5.5 projects that contain Industrial Ethernet CPs with activated security functions,
the security settings are disabled during migration to STEP 7 Professional.
If necessary, follow these steps after the migration:
1. Activate the security functionality.
2. Configure the required security settings.

Migration of IP access protection lists when activating the security functions

An active IP access protection list is converted to firewall rules when security functions are
activated. These rules are visible in advanced firewall mode and can be adjusted there. The
advanced firewall mode is activated automatically.

Readme
36 Programming and Operating Manual, 11/2019
 STEP 7
2.4 Editing devices and networks

Security online diagnostics of S7 CPs

Security online diagnostics of a CP with security capability is only possible if the online
connection is established directly via the CP. If the online connection was established by
STEP 7 via the CPU to the station, with the "Connect online" button on the security diagnostics
page "Security" > "Status" of the security CP you can establish a direct connection to the CP to
run security online diagnostics. As an alternative, you can also terminate the online connection
to the CPU and enter the IP address of the CP in the "Station address" input box under the entry
"Online access" in online diagnostics.

IKE mode
When negotiating the key in phase 1 the IKE mode "Main" should be preferred. This mode
normally provides a reliable procedure compared with the "Aggressive" mode. One reason for
using the "Aggressive" setting is when you have VPN groups with different pre-shared keys.
The IKE "Aggressive" mode should not be used in conjunction with certificates. In the IKE
"Aggressive" mode, only use pre-shared keys.
A security module must not be used in VPN groups that use different IKE modes.

Downloading configuration data to an S7-300/400 via a VPN tunnel

When you download configuration data via the gigabit interface of a CP x43-1 Advanced to an
S7-300/S7-400 station, the path via which the download takes place is stored in the project. If
the project is then downloaded via a VPN tunnel established between a SCALANCE S module
and the CP x43-1 Advanced, the download fails due to the changed path.
To download via the VPN tunnel, follow the steps below:
1. Using the "Go online" button, connect the engineering station to the gigabit interface of the
CP x43‑1 Advanced.
2. Disconnect the online connection to the CP x43‑1 Advanced.
3. Download the project to the station via the gigabit interface of the CP x43‑1 Advanced.

VPN tunnel establishment with 1200/1500 CPs capable of VPN

The establishment of VPN tunnel connections by 1200/1500 CPs capable of VPN with the
authentication method "pre-shared key" is only possible if the VPN connection partner is also
a 1200/1500 CP capable of VPN. The establishment of VPN tunnel connections by a
1200/1500 CP capable of VPN to all other VPN connection partners is only possible with the
"certificate" authentication method.

Security configurations from old projects

Before a security configuration from an older STEP 7 version in STEP 7 V14 can be used, a
user with administrator rights needs to log in to this security configuration in STEP 7 V13 SP1
and save the project. After opening the project in STEP 7 V14, a user must log on again to the
security configuration with administrator rights. Thereafter, it is possible to use this security
configuration in STEP 7 V14.

Readme
Programming and Operating Manual, 11/2019 37
STEP 7
2.4 Editing devices and networks

Copying security modules between STEP 7 instances

Copying security modules between different instances of STEP 7 is not supported.

Device certificates for CP 1543-1 V2.0 and CP 1543SP-1

For CP 1543-1 V2.0 and CP 1543SP-1, only those device certificates that are assigned to the
module via the local certificate manager as device certificates are loaded to the module. This
assignment takes place in the local security settings of the module in the "Certificate manager"
entry via the "Device certificates" table editor. The certificates of the global certificate manager
are available for the certificate assignment.

No fallback VPN profiles for CP 1200/1500

Fallback VPN profiles are not supported by the CP 1200/1500. Configured fallback VPN
profiles are therefore not loaded on the CP 1200/1500.

Media converters
When you migrate a project, you need to reconfigure the media converters.

Readme
38 Programming and Operating Manual, 11/2019
 STEP 7
2.5 Programming a PLC

2.5 Programming a PLC

2.5.1 General notes on PLC programming

Contents
Information that could not be included in the online help and important information about
product characteristics.

Instance-specific attributes when importing blocks via TIA Portal Openness

In certain situations, the import rules can mean the loss of instance-specific attributes, such as
start values.

Display of the CPU name in system alarms

As of V15.1, the name of the CPU (or for H or R CPUs, the name of the station) is displayed in
the "Additional text 1" column of the system alarms. To do this, you need to compile the
hardware of the device in question. If the CPU name is not displayed via the "Compile >
Hardware (only changes)" option, use the option "Compile > Hardware (rebuild all)".
Make sure that loading to the device is actually performed; the message that the hardware is
up-to-date is not enough!

Modifying the application cycle of an isochronous mode interrupt OB

When you change the "Application cycle (ms)" parameter of an isochronous mode interrupt OB,
you implicitly also modify the hardware configuration. To ensure that the modified value for the
application cycle duration becomes effective after the next loading process of the CPU you
have to explicitly include the hardware configuration in loading. To this purpose select either the
menu command "Load to device > Hardware and software" or the command "Load to device >
Hardware configuration".

Using the system data type "TDiag_StatusExt" (S7-1200/1500)

Alternatively to the "TDiag_Status" system data type, the extended system data type
"TDiag_StatusExt" can be used to obtain more detailed information about the cause of a lost
connection. In particular, the reading out of the structure element "LastConnErrTimeStamp"
causes the CPU to switch to "Defect" system state and must not be used currently.

Readme
Programming and Operating Manual, 11/2019 39
STEP 7
2.5 Programming a PLC

Information about network security

For communications access between TIA Portal and CPU or between HMI (except for HMI
access using "GET/PUT communication") and CPU, there are integrated security functions.
These provide greater protection from manipulation and higher access protection. To protect
against unauthorized network access to a CPU with standardized communications access
such as "GET/PUT", "TSEND/TRCV", "Modbus", "FETCH/WRITE", you should also take
suitable additional measures (e.g. cell protection concept).

Functions from the global library "Long Functions" with PLCSIM (S7-1500)
The compilation process links the functions of the S7-1500 CPU family to the CPU to protect
them from manipulation. Function from the global library "Long Functions" that are used in the
CPU and have such a link cannot be loaded to a simulation. However, it is possible to replace
such elements with their originals from the global library. These are not linked to a CPU.

Loading inconsistent programs to an S7-1500 CPU (S7-1500)

In TIA Portal, it is not possible to download inconsistent programs to an S7-1500 CPU without
a consistency check. During the loading process, all blocks of the program are implicitly
checked and are compiled again in the event of inconsistencies. If, however, there are
programs on your CPU which were loaded with earlier versions of STEP 7, these programs
could demonstrate inconsistencies.
In this case, note the following:
If you load an inconsistent program from a device, you will not be able to load the program back
to an S7-1500 CPU unchanged afterwards, because a consistency check always takes place
during the loading process and existing inconsistencies are corrected.

Data exchange between standard and F-program when using Team Engineering
To ensure data consistency between standard and safety program, you should:
● Do not exchange data via bit memory, use global data blocks instead.
● Limit access between safety programs and standard user programs to two standard data
blocks.
You can find additional information on this in section 5.13 of the Programming Guidelines
under: [Link] ([Link]
document/81318674/programming-guideline-and-programming-styleguide-for-s7-1200-and-
s7-1500?dti=0&lc=en-WW)

2.5.2 Notes on instructions

Contents
Information that could not be included in the online help and important information about
product characteristics.

Readme
40 Programming and Operating Manual, 11/2019
 STEP 7
2.5 Programming a PLC

"FileDelete: Delete file on the memory card" instruction

Contrary to what is stated in the online help, the following applies to the values 8091 and 8094
of the "Status" parameter:
● The value 8091 has the following meaning: Path does not exist or is invalid.
● The value 8094 is not output.

2.5.3 Testing the user program

[Link] Information on testing with the watch table

Contents
Information that could not be included in the online help and important information about
product characteristics.

Multiple access to the same CPU (S7-300/400/1200)

Online access to a CPU (S7-300/400/1200) from a PG/PC is permitted only when a TIA Portal
is open. Multiple access to the same CPU of this family is not permitted and can lead to errors.

Loading data blocks during an active control job

Loading changed data blocks during an active control job can result in unforeseen operating
states. The control job continues to control the specified address, although the address
assignment might have changed in the data block. Complete active control jobs before loading
data blocks.

"Enable peripheral outputs" function

The function "Enable peripheral outputs" in not available for CPUs of the S7-1500 series in TIA
Portal.
This function can only be executed with an S7-300, S7-400 or S7-1200 CPU in TIA Portal.

Testing of programs that have been migrated from older STEP 7 versions.
To monitor and test a program migrated from an older STEP 7 version, you first need to compile
and download the program with the current STEP 7 version.

Readme
Programming and Operating Manual, 11/2019 41
STEP 7
2.5 Programming a PLC

Testing of programs that have been upgraded

After upgrading the project to V16, a new checksum calculation is performed internally. In rare
cases this can result in no values being displayed for variables in the watch table, because the
checksum has changed even though the blocks are identical. No value is then displayed in the
"Observed value" column; the glasses with the crossed out red circle are displayed instead. In
this case, the project must be recompiled and reloaded before it can be observed and tested
online with the watch table.

Changed display formats in the watch table

The number of display formats has been reduced so that display formats that are used but no
longer supported are reset to the defaults during a project upgrade.
Example: Pointers can now only be shown in "Pointer" or "Hexadecimal" format.

[Link] Information on testing with the force table

Contents
Information that could not be included in the online help and important information about
product characteristics.

Forcing tags for direct I/O access (S7-300)

If you use direct I/O access for an S7-300 CPU in your user program, forcing this I/O address
is not permitted.

Example
If I/O access to the address "IB0:P" takes place in the user program, it is not permitted to force
the following I/O address areas: I0.0:P, IB0:P, IW0:P and ID0:P.

Changed display formats in the force table

The number of display formats has been reduced so that display formats that are used but no
longer supported are reset to the defaults during a project upgrade.
Example: Pointers can now only be shown in "Pointer" or "Hexadecimal" format.

[Link] Information on testing with breakpoints

Contents
Information that could not be included in the online help and important information about
product characteristics.

Readme
42 Programming and Operating Manual, 11/2019
 STEP 7
2.5 Programming a PLC

Setting breakpoints in the standard user program at S7-1500 F-CPUs

If a breakpoint is enabled and is reached, the CPU immediately goes to STOP after HOLD. If
you want to change back to RUN mode after the HOLD in order to continue testing your default
user program, you can simulate this with S7-PLCSIM.
Further information about testing with breakpoints at F-CPUs is available in the "SIMATIC
Safety – Configuring and Programming" manual.

2.5.4 Upgrading blocks

Contents
Information that could not be included in the online help and important information about
product characteristics.

Upgrading know-how-protected blocks (S7-1200/1500)

When upgrading to the current version, know-how protected blocks that were set up with an
older version of TIA Portal can be loaded in the controller without entering a password and are
executable.
To open and edit these blocks in the current version, proceed as follows:
● For blocks with know-how protection set up using version V13 SP1 or higher:
– Remove the know-how protection in the current version, edit the block and reset the
know-how protection.
● For blocks with know-how protection set up using a version earlier than V13 SP1:
– Remove the know-how protection in V13 SP1 and then update the block to the current
version. Now edit the block and reset the know-how protection in the current version.

Upgrading of GRAPH blocks (S7-300, S7-400, S7-1500)

After upgrading a project to V16 from a version lower than V15, check whether repaired
GRAPH blocks are listed in the log file and test whether these blocks are executable in your
program.
If a project contains GRAPH blocks and is upgraded from V15.x to V16, the program blocks
have to be compiled before they can be monitored.

Compare offline/online
Corrections to internal project data have been made in the current version in order to enhance
data integrity. After installation, this enables individual blocks to be corrected automatically
upon opening, which is why the offline/online comparison displays different checksums.

Readme
Programming and Operating Manual, 11/2019 43
STEP 7
2.5 Programming a PLC

Updating device specifications

When upgrading your project, internal device specifications of the used employed CPUs are
updated in certain cases.
The following message indicates that an update is being performed: "The device configuration
of the PLCs in the project has been updated."
The update has no effect on the program running in the CPU.

2.5.5 Compatibility of PLC programs from older versions

[Link] Compatibility of PLC programs from versions prior to V16

Contents
Information that could not be included in the online help and important information about
product characteristics.

Compatibility
In principle, you can continue to use in V16 all PLC programs that were created with older
versions of TIA Portal. However, because improvements were made to the compiler and errors
corrected there in V16, it can occur in rare cases that the program reacts differently after the
upgrade or that you have to adjust the program code manually. These cases are described in
detail below.

Checksum inconsistency
After upgrading a project to V16, online/offline differences might be indicated although the
online and offline programs are identical. These differences are due to optimization of the
calculation of checksums in V16. But the blocks are still compatible in most cases.
In some rare cases, however, you might have to recompile and download the project again due
to the changes in the checksum calculation before you can monitor and test the project online.

Software units
As of V16, the following rules apply for the name of a software unit:
● Permissible characters are all alphanumeric characters and the underscore.
● The maximum number of characters is 125.
● The name of a software unit must be unique for the entire CPU and no block with the same
name must exist in the CPU.
If the software unit in your program does not conform to these rules, a syntax error is displayed
after the upgrade. In this case, change the property of the software unit and recompile the
program.

Readme
44 Programming and Operating Manual, 11/2019
 STEP 7
2.5 Programming a PLC

Syntax check for instances (LAD, FBD, STL, GRAPH)

A more thorough check is now performed when calling a function block to determine whether
the specified instance data block is of the type of the called FB. In addition to the block number
and the block structure, the block name is now also being checked.
A syntax error is output after the upgrade in case of inconsistencies. In this case, check the type
of the instance data block in the "General" section of the block properties. If the type does not
match the called FB, you must change the block call and specify a matching instance.

Instructions "UPPER_BOUND" and "LOWER BOUND" (LAD, S7-1200/S7-1500)

The enable input "EN" of the two instructions "UPPER_BOUND" and "LOWER BOUND" is now
evaluated correctly. If the input "EN" has the signal state "0", the instruction is not executed and
the enable output "ENO" has the signal state "0". When you use one of the two instructions,
check whether your program sequence is still the same after the upgrade.

Instruction "S_CONV" (LAD)

The enable input "EN" of the "S_CONV" instruction was not evaluated in older TIA Portal
versions during conversion from (W)Char to (W)String when no parameter was interconnected
at the enable output "ENO". This behavior has been corrected. When you use "S_CONV",
check whether your program sequence is still the same after the upgrade.

Initialization of STRUCT data type when importing external source files (SCL)
The initialization rules for STRUCT have been made uniform. The initialization lists are now
always evaluated according to the same rules, regardless of whether you are working in the
tabular form or in the textual block interface.
If you use a different syntax in an initialization list and initialize some elements by specifying the
element name and others only by specifying the value, for example, check your program after
importing it into TIA Portal V16.
The following example shows how the structure elements in V16 are evaluated both in tabular
form and in the textual block interface:
myStruct : Struct
member_1 : Int;
member_2 : Int;
member_3 : Int;
member_4 : Int;
member_5 : Int;
End_Struct:=(1,mem_3:=33,2,3);

//The structure elements are initialized as follows:

//mem_1 := 1;
//mem_3 := 33;

Readme
Programming and Operating Manual, 11/2019 45
STEP 7
2.5 Programming a PLC

//mem_4 := 2;
//mem_5 := 3;

AT declaration
In rare cases, incorrect values were written to block parameters that immediately followed an
AT declaration in the interface. This behavior has been corrected.
It is no longer possible to overlay block parameters of the data types BOOL, BYTE, SINT,
USINT or CHAR with tags of the data types STRUCT and UDT. Overlays with ARRAY type tags
are only possible as long as the array size does not exceed the data size of the overlaid type.
If you use AT declarations, check your program after the upgrade.

"MOVE" instruction
With the "MOVE" instruction you can only copy all the tags of a data block into another data
block ("DA a" := "DB b") if both blocks have the same structure, i.e. the number, the data type
and the declaration sequence of the declared tags are identical. In addition, both data blocks
must have the same storage format (optimized or non-optimized).
If both blocks are available in an optimized storage format, all tags of both blocks must be either
retentive or non-retentive.

"MOVE" instruction (STL)

As of TIA Portal V16, it is no longer possible in STL to supply the OUT output of a MOVE
instruction with a tag of the VARIANT data type from the sections InOut or Out of the block
interface.

Instructions "SCATTER_BLK" and "GATHER_BLK" (SCL)

As of V16 the permissible data types have been restricted: When using structures (STRUCT or
PLC data type) as parameters, these must only contain tags of the data type BOOL.

Non-typed constants (SCL)

The semantics check for non-typed constants has been adapted to the other programming
languages: If a non-typed constant is not compatible with the assigned operand, a compilation
error is always reported if the IEC check is activated.

Addressing ARRAYs via variable index and I/O access (S7-1200)

In a CPU of the S7-1200 series, addressing ARRAYs via a variable index in combination with
the I/O access identifier ":P" is no longer possible.

Example of an invalid ARRAY addressing:

#array[0, #myIndexTag, 2]:P

Readme
46 Programming and Operating Manual, 11/2019
 STEP 7
2.5 Programming a PLC

Examples of permissible ARRAY addressing with I/O access:

#array[0, #myConstant, 2]:P
#array[0, 1, 2]:P

Examples of permissible ARRAY addressing with variable index:

#array[0, #myIndexTag, 2]

Block size when using ARRAYs in structures

When using structures (STRUCT) that contain more than one ARRAY element, the following
error can occur:
If multiple ARRAY accesses were outside the valid range, the CPU did not switch to STOP but
an ARRAY element was accessed.
This behavior has been corrected in V16: The CPU switches to STOP in this case or runs a local
or global troubleshooting if it is programmed.
This correction allows for the respective blocks to be larger.

Size of GRAPH blocks

Note that all GRAPH blocks will be about 90 bytes larger due to the correction described above.

Assignment of non-typed constants (SCL)

An error message is generated for assignments of non-typed constants to tags of the "Real"
type when the IEC Check is enabled, and when the constant is also located within the value
range of an LReal and outside the value range of a Real.

[Link] Compatibility of PLC programs from versions prior to V15.1

Contents
Information that could not be included in the online help and important information about
product characteristics.

Compatibility
Basically, you can continue to use all PLC programs that were created with older versions of
TIA Portal in V15.1. However, because improvements were made to the compiler and errors
corrected there in V15.1, in rare cases the program may react differently after the upgrade or
you may have to adapt the program code manually. These cases are described in detail below.

Readme
Programming and Operating Manual, 11/2019 47
STEP 7
2.5 Programming a PLC

Processing sequence of function calls in SCL (S7-1200/S7-1500)

In older versions of the TIA Portal, the processing sequence of assignments containing
expressions or function calls was not always clear. Processing was not carried out consistently
from right to left; rather, in certain cases, parts of the expression on the left side were evaluated
first.
This behavior was corrected in V15.1 so that the right side of the assignment is always
calculated first and then the left side is determined.
Example:
#myArr["FC_1"()]:= #x + #y;
In earlier versions, the "FC1" was run here first in order to determine an ARRAY element. Then,
#x + #y was calculated.
As of V15.1, the program is now correctly processed from right to left: First, #x + #y is calculated
and then "FC1" is run.
This correction can have the result that your program behaves differently after upgrade, e.g.
when the tags #x or #y are set in "FC1". Therefore, please check your program after upgrading.

Comparators (SCL S7-1200 >= 4.2 and S7-1500 >= 2.0)

When comparing two instance data blocks via comparison instructions in SCL, not the structure
of the blocks but only the block numbers are compared. As of V15.1, an error message during
compiling notifies you that this instruction may not return the desired result (FALSE is generally
returned because the numbers of the blocks are different).
Example:
The result of the following comparison instruction is FALSE even if the structure of the two
blocks is identical.
IF "MyDBofFB" = "MyDBofSameFB" THEN …

Importing IEC timers (S7-1200/S7-1500)

IEC timers contain read-only parameters, e.g. ET (current time value). In older versions of the
TIA Portal, the start values of these read-only parameters were overwritten in some cases
when external source files were imported. This behavior was corrected with V15.1: Start values
for read-only parameters are now ignored when source files are imported. Instead, the default
values of the data type are used. Therefore, please check your program after an import.

Replacing invalid Unicode characters during upgrade

Invalid Unicode characters in your program are corrected when upgrading to V15.1. For
example, invalid characters in string constants are replaced with the escape sequences
defined by IEC. This can change the checksum of the program and indicate differences
between the online and offline program. Compile your program and reload it in this case.

Readme
48 Programming and Operating Manual, 11/2019
 STEP 7
2.5 Programming a PLC

Instructions "SCATTER" / "SCATTER_BLK" and "GATHER" / "GATHER_BLK" (SIMATIC

S7-1200/1500)
You can use the "SCATTER" / "SCATTER_BLK" instructions to parse the bit sequence into
individual bits. You can use the "GATHER" / "GATHER_BLK" instructions to combine individual
bits into a bit string.
The values with which the instructions work must not be in the I/O area or in the DB of a
technology object, since data consistency cannot be guaranteed in these areas.
As of V15.1, this rule undergoes a more precise syntax check. If you have the above-mentioned
instructions with invalid input parameters in your program, an error is now reported during
compiling.
As a remedy, you can first copy the tags to a temporary memory area and transfer them from
there to "SCATTER" or "GATHER" instructions.

Instructions "BLKMOV" / "UBLKMOV" and "FILL" / "UFILL"

Use the "BLKMOV" / "UBLKMOV" and "FILL" / "UFILL" instructions to copy the contents of a
memory area (source range) to another memory space (target range). If these instructions
access a memory area that does not exist, a programming error is output. In previous versions,
in rare cases an error code was generated at the "RET_VAL" parameter instead of a
programming error. This behavior has been corrected for S7-1500 CPUs as of firmware version
2.6.

"RUNTIME" instruction (SCL/STL S7-1200/S7-1500)

The "Mem" parameter of the "RUNTIME" instruction has the data type "LREAL" and can only
be used with a tag of this data type. Implicit conversion is not possible here. In V15.1, this rule
undergoes a more precise syntax check. If you have provided the "Mem" parameter of the
"RUNTIME" instruction with an invalid data type in your program, an error is now reported
during compiling.

[Link] Compatibility of PLC programs from versions prior to V15

Contents
Information that could not be included in the online help and important information about
product characteristics.

Compatibility
In principle, you can continue to use in V15 all PLC programs that were created with older
versions of TIA Portal. However, because improvements were made to the compiler and errors
corrected there in V15, it can occur in rare cases that the program reacts differently after the
upgrade or that you have to adjust the program code manually. These cases are described in
detail below.

Readme
Programming and Operating Manual, 11/2019 49
STEP 7
2.5 Programming a PLC

S7-GRAPH: Implicit conversions "Hardware data type <> INT"

As of TIA Portal V15 it is no longer possible to program implicit conversions of hardware data
types (for example INT -> DB_ANY or DB_ANY -> INT), as is already the case in LAD, FBD,
STL and SCL.
Please use either the UINT data type or an explicit conversion instead.

Subcategories in ProDiag (S7-1500)

From TIA Portal V14 SP1 update 2 the individual subcategories for ProDiag are no longer
added manually, but activated or deactivated in the "Activation" column.
This results in the fact that following the upgrade of a project <V14 SP1 Update 2, which uses
already existing subcategories in at least one monitoring, the "Repair" button must first be
selected before you can create new subcategories.

Instructions "(U)MOVE_BLK" and "(U)FILL_BLK" (S7-1500)

The instructions "(U)MOVE_BLK" and "(U)FILL_BLK" only accessed the process image in TIA
Portal <= V15 when directly accessing the I/O.
This behavior has been corrected and now causes a runtime error because direct I/O access
is not permitted for BLK instructions.

Program loops in SCL (S7-1200/S7-1500)

In S7-1200/S7-1500 it is not possible to change the index of a program loop from within the loop
with SCL.
The following program example would therefore be invalid:
FOR #i := 1 TO 10 DO
#i := #i + 1;
END_FOR;
As of TIA Portal V15, a more exact syntax check is conducted in this regard during compilation
and a compilation error is output.

Return values for functions in SCL

The behavior for functions whose return values have a structured data type has been adjusted.
Structured data types are e.g. PLC data types or STRING.
Regardless of whether or not the ENO output uses the function, until now, it could happen that
a temporary working copy of the function value was created although no working copy was
created by the same call without ENO. The assignment of these temporary copies to the
interconnected tag is made when the function is exited.
This behavior was changed as follows:
Using the output parameter ENO now no longer has any influence on whether the return value
is transferred with a copy or with a reference. If the return value has a structured data type, it
is generally transferred as a reference. The transfer rules are described in detail in the section
"Transfer parameter as copy or as pointer".

Readme
50 Programming and Operating Manual, 11/2019
 STEP 7
2.5 Programming a PLC

LDT_TO_DATE in SCL (S7-1500)

The reaction of LDT_TO_DATE to a conversion error in runtime was corrected.

Comparison of an ARRAY element with a variable of the data type "VARIANT" in SCL (S7-1200/1500)
In the past the comparison of a variably indexed ARRAY element with a VARIANT was not
carried out correctly in some cases. Instead of the ARRAY element the complete ARRAY was
used for the comparison.
This behavior has been corrected in V15: The indexed ARRAY element is now evaluated for
the comparison. If you use such comparisons in your program, you have to check the
respective block after upgrading.
Example:
IF (#my_Array[#1] = #my_variant) THEN…
In the past "my_variant" was compared with "my_Array". As of V15 the comparison is carried
out correctly and "my_variant" is compared with Element #1 of "my_Array".

Instruction "GetSymbolPath" (S7-1200/S7-1500)

If an FB interconnects a static variable to a formal parameter of a call and a nested block uses
"GetSymbolPath" V1.0 or V1.1 for the parameter, compiling this block results in an additional
display of the DB name before the name of the static variable, however, without a period as a
delimiter and without replacement of the #. Version V1.2 of "GetSymbolPath" shows the path
correctly with a period as a delimiter and without #.
If you use the "GetSymbolPath" instruction in your program, you should use the
"GetSymbolPath" V1.2 instruction after upgrading to >=V15.

Instruction "GetInstancePath" (S7-1200/S7-1500)

If an FB interconnects a static variable to a formal parameter of a call and a nested block uses
"GetInstancePath", compiling this block results in an additional display of the DB name before
the name of the static variable.

Additions and subtractions with DTL/LDT/DT

In additions and subtractions with the data types DTL/LDT/DT, non-typed constants can no
longer be used. A syntax error is signaled.
The following arithmetic operations, for example, are no longer possible:
#myDTL + 1
#myLDT + 1
#myDate_And_Time +1
Use constants of the data type "Time" or "LTime" instead
#myDTL + TIME#1d
#myLDT + TIME#1ms

Readme
Programming and Operating Manual, 11/2019 51
STEP 7
2.5 Programming a PLC

#myDate_And_Time + LTIME#1ns

Runtime information (S7-1200/S7-1500)

The extended instructions "GetInstanceName", "GetInstancePath", "GetSymbolName",
"GetSymbolPath" and "GetBlockName" now behave in the same way in all programming
languages: If the character string to be output does not fit in the output parameter on account
of size restrictions, the name is truncated and the character "..." is displayed at the end of the
character string.

ARRAYs of multi-instances
In the past ARRAYs of multi-instances could not be addressed correctly when variables were
used to address the index of a multi-instance that was in turn instantiated in a further multi-
instance, that in turn was an element of an ARRAY of multi-instance.
Example:
#MyMultiArray[#index].MyMultiMember := 10;
This behavior has been corrected in V15:
If you have used such accesses in your program, you may have to check the affected block
after upgrading and possibly recompile it.

Block parameters of the data type "VARIANT" (S7-1200/1500)

As is already the case in LAD, FBD, STL and GRAPH, it is now no longer possible either in SCL
to assign and instance DB as the actual parameter to a formal parameter of the data type
"VARIANT".
An exception is formed by instance DBs that are derived from a PLC data type or a system data
type. You assign these to a block parameter of the data type "VARIANT" in all programming
languages.
It is no longer possible to assign a write-protected tag for a block parameter of the data type
"VARIANT" as an actual parameter.
If possible, remove the write protection of the variable. If this is not possible, check how you can
change your program to prevent access to the write-protected variable. If you only want to have
read access, for example, you can copy the content of the write-protected variable in the calling
block into a different variable without write protection. Subsequently you can hand over this
variable as an actual parameter.

Importing external sources

When importing an external source in which an instruction is used as a multi- or single-instance,
the entire program was changed to the instruction version used in the source in the past. As of
Version V15 of TIA Portal this behavior has been corrected: The instructions already contained
in the project are no longer changed over, but rather retain the instruction version configured by
you.
If the project contains different versions of an instruction after the import, a syntax error is
reported. In this case compile the complete project again. To do so, select the "Program blocks"

Readme
52 Programming and Operating Manual, 11/2019
 STEP 7
2.5 Programming a PLC

folder in the project tree and select the command "Compile > Software (only changes)" or
"Compile > Software (compile all)" from the shortcut menu.

Size of ARRAY of BOOL/BYTE/CHAR (S7-1500)

In the past ARRAYS of the data types BOOL, BYTE or CHAR had different sizes depending on
whether they were used within a structure or not. As of V15 the size of the ARRAYs has been
standardized. If you access absolutely in your program, for example by using an ANY pointer
to an ARRAY of the type of BOOL, BYTE or CHAR, you have to check the program after
upgrading.

[Link] Compatibility of PLC programs from versions prior to V14 SP1

Contents
Information that could not be included in the online help and important information about
product characteristics.

Compatibility
In V14 SP1 you can generally continue to use all programs that were created with older
versions of TIA Portal. However, because improvements were made to the compiler and errors
corrected there in V14 SP1, it can occur in rare cases that the program reacts differently after
the upgrade or that you have to adjust the program code manually. These cases are described
in detail below.
In addition, you have the option of editing the project in compatibility mode. You can find
additional information on the compatibility under "Compatibility of projects".

Total size of the associated values for program messages

The alarm procedure of the S7-1500 CPU allows a maximum of 512 bytes for associated values
(SD parameters) of the instruction "Program_Alarm".
You will only see a warning regarding this number in TIA Portal <= V14 during compilation.
There is a stricter check as of TIA Portal V14 SP1. If this number is exceeded, an error is output
during compilation to rule out error scenarios during runtime. This check from now on no longer
refers to the actual size of the SD parameters at the time the instruction "Program_Alarm" is
called, but to the maximum possible size of the SD parameters. This means you must decide
beforehand with what length you declare the character string tags you are transferring, as these
take up a large number of bytes.
This must be taken into account in the migration of projects from version <= V14 to version V14
SP1 Update 1.

Program loops in SCL (S7-1200/S7-1500)

In S7-1200/S7-1500 it is not possible to change the index of a program loop from within the loop
with SCL.
The following program example would therefore be invalid:

Readme
Programming and Operating Manual, 11/2019 53
STEP 7
2.5 Programming a PLC

FOR #i := 1 TO 10 DO
#i := #i + 1;
END_FOR;
As of TIA Portal V14.0.1, a more exact syntax check is conducted in this regard during
compilation and a compilation error is output.

CASE statements in SCL

Labels without associated "GOTO" instruction are no longer permitted in a CASE statement. A
syntax error is signaled.

ARRAYs of multi-instances
In some cases ARRAYs of multi-instances could not be correctly be addressed in V14 when
individual tags within a multi-instance had the retentivity setting "Set in IDB". This behavior has
been corrected in V14 SP1.
If you have used such tags in your program, you may have to recompile the affected block after
upgrading.

Parameter type "Block_DB" for entry of the instance DB

In LAD and FBD, you cannot enter the instance DB of an instruction using an input of the data
type "BLOCK_DB". This behavior has been made uniform for all CPU families and all block
types.
As of TIA Portal V14 SP1, a syntax error is output.
If you have transferred instance DBs in your program with the help of the "Block_DB" data type,
you change your program. Instead use a parameter instance to transfer the instance during
runtime.

I/O accesses as input parameters of blocks (S7-1500 as of FW V2.1)

In the event of an I/O access error, direct I/O accesses which are interconnected as input
parameters to blocks no longer result in the block being run through. Instead of this, the system
uses the replacement value of the signal in the block.
For CPUs S7-1500 with FW smaller than V2.1 and all CPUs S7-1200, system behavior is
unchanged:
The block is not called as a result of the I/O access error. Program execution is continued after
the block call. If OB 122 exists or local error handling is enabled, these are executed.

[Link] Compatibility of PLC programs from versions prior to V14

Contents
Information that could not be included in the online help and important information about
product characteristics.

Readme
54 Programming and Operating Manual, 11/2019
 STEP 7
2.5 Programming a PLC

Compatibility
In principle, you can continue to use in V14 all PLC programs that were created with older
versions of TIA Portal. However, because improvements were made to the compiler and errors
corrected there in V14, it can occur in rare cases that the program reacts differently after the
upgrade or that you have to adjust the program code manually. These cases are described in
detail below.

STL: Instructions "SRW", "SLW" and "SSI" (S7-300, S7-400, S7-1500)

The permitted value range of the offset number of these instructions has changed in TIA Portal
V14 from TIA Portal V13 SP1.
In version V13 SP1, it is possible to specify a number in the range 0 to 31 as an offset number
on a CPU of the S7-1200/1500 series and a number in the range 0 to 15 as an offset number
on a CPU of the S7-300/400 series.
As of Version V14, the value ranges for all CPU series (S7-300/400/1200/1500) was set to the
uniform value from 0 to 15.

Representation of the BCD format

The representation of the BCD format has changed in regard to the sign from TIA Portal V13
SP1 to TIA Portal V14.
The values in BCD format are show without signs in version V13 SP1.
As of version V14, the values in BCD format are show with sign. This can lead to an altered
representation of the values in BCD format.

Integers (decimal system) Hexadecimal Representation in V13 Representation in V14

numbers SP1
0 16#0000 BCD#0 BCD#0
-26215 16#9999 BCD#9999 BCD#-999
1365 16#0555 BCD#555 BCD#555
21845 16#5555 BCD#5555 BCD#555
4096 16#1000 BCD#1000 BCD#0
-28672 16#9000 BCD#9000 BCD#0

Instructions "SET_BF: Set bit field" and "RESET_BF: Reset bit array" (S7-1200, S7-1500)
The response of the instruction in regard to the structures has changed from TIA Portal V13
SP1 to TIA Portal V14.
In version V13 SP1, the number of bits that set or reset are always indicated at the input. This
also applies, for example, if you have specified a structure of data type of the STRUCT or
ARRAY PLC data type. If you want, for example, you want set or reset 10 bits and the structure
contains only 5 bits, then the following 5 bits within the address sequence is also set or reset.
With structures of the type PLC data type, as of version V14 STRUCT or ARRAY the number
of bits contained in the structure represents the maximum number of bits that can be reset: If
you specify the value "20", for example, and the structure only contains 10 bits, only these 10

Readme
Programming and Operating Manual, 11/2019 55
STEP 7
2.5 Programming a PLC

bits are set. If you specify the value "5", for example, and the structure contains 10 bits, then
exactly 5 bits are set.

Instructions "SCALE: Scale" and "UNSCALE: Unscale" (S7-1500)

The response of the instruction has changed from TIA Portal V13 SP1 to TIA Portal V14 in
regard to specifying the limits (LO_LIM> HI_LIM).
In version V13 SP1, you received an error message when the low limit was greater than the
high limit.
As of version V14, this value is allowed and the result is inversely proportional to the input value.
On CPUs of the S7-300/400 series, the instruction has always scaled the result inversely
proportional to the input value.

Unused bits of PLC data types (UDT) with firmware >= V1.8.1
The unused bits of PLC data types in standard memory areas are occupied or overwritten, for
example, for a PLC data type that contains 4 bits.
With firmware versions < V1.8.1, you could not use the unused bits of a PLC data type
elsewhere.
With firmware version >= V1.8.1, all bits are occupied or overwritten even if only 4 bits are used.

Note
Address assignments
Ensure you do not assign the same absolute address twice to different symbolic address
assignments.

Explicit data type conversion in SCL (S7-1200) with firmware >= V4.2
With firmware versions < V4.2, the string was transferred aligned to the right and filled with
leading spaces during explicit data type conversion of SINT/INT/DINT/REAL_TO_STRING/
WSTRING in SCL.
Example: REAL_TO_WSTRING(12) = ' 1.200000E+1'
As of TIA Portal V13, the string is displayed with a leading sign during explicit data type
conversion of SINT/INT/DINT/REAL_TO_STRING/WSTRING in SCL and transferred aligned
to the left.
Example: REAL_TO_WSTRING(12) = '+1.200000E+1'

SCL: EN/ENO mechanism with block parameters of data type (W)STRING (S7-1200/1500)
As of TIA Portal V14, it is checked whether block parameters of data type (W)STRING are
truncated when parameters are transferred during runtime. This can occur if formal and actual
parameters have different declared lengths. If the declared length of the target parameter
during runtime is insufficient to accept the (W)STRING, the (W)STRING is truncated and the
enable output ENO is set to "FALSE".

Readme
56 Programming and Operating Manual, 11/2019
 STEP 7
2.5 Programming a PLC

If you evaluate the enable output ENO in your program, the semantics of your program may
change.

Forwarding STRING parameters between optimized blocks and standard blocks (S7-1200/1500)
Prior to TIA Portal V14, no length information about STRINGs was transferred when
parameters were transferred between optimized and non-optimized blocks. This meant that
access errors not detected by the ENO mechanism could occur during the further processing
of the STRING. The enable output ENO remained at TRUE despite an access error.
As of TIA Portal V14, the STRING length information is transferred and access errors are
monitored by the ENO mechanism. If you evaluate the enable output ENO in your program, the
semantics of your program may change.

Length declaration for constants of the "STRING" or "WSTRING" data type

Length declarations are no longer permitted for local and global (W)STRING constants. If your
program includes length declarations, for example, "MyStringConst [7]", these are
automatically removed during the upgrade. This change has no semantic effect on your
program, however.

Changing the base data type for HW_ANY from WORD to UINT
The hardware data type "HW_ANY" is used to identify any hardware component, such as a
module. In V14, the base data type of "HW_ANY" was changed from WORD to UINT. After the
conversion to V14, compiling errors can therefore occur if you have assigned an explicit WORD
constant (such as W#16#1) or a tag of data type WORD at a parameter of data type "HW_ANY".
In this case, change the notation of the constant (e.g. to 16#1) or change the data type of the
tag to UINT.

Length of block comments

As of TIA Portal V14, the block comments must not exceed a length of 32767 Unicode
characters.

Syntax check of the instructions "SR: Set/reset flip-flop" and "RS: Reset/set flip-flop"
Inputs, outputs, bit memories as well as static or local data can be used as operands at the "S"
input. Use of constants is not permitted. So far, the use of the constants "0" and "1" was not
rejected by the syntax check. As of TIA Portal V14 the syntax check was improved so that the
use of "0" or "1" is now rejected at the "S" input. You may now receive an error message during
the compiling of a program that has been compiled without errors up to this point. Change your
program in this case and use a permitted operand.

Any pointer: Access to optimized data

For a CPU of the S7-1500 series, the ANY pointer can also only point to memory areas with
"Standard" access mode. Access to optimized data is not permitted with an ANY pointer.

Readme
Programming and Operating Manual, 11/2019 57
STEP 7
2.5 Programming a PLC

A more detailed syntax check of ANY pointers is performed as of TIA Portal V14. Access to
optimized data is now rejected. You may now receive an error message during the compiling
of a program that has been compiled without errors up to this point.

"(L)REAL" data type

With 64-bit Windows versions, the LREAL data type is sometimes evaluated differently than
with the previous 32-bit versions of Windows. A difference may occur when rounding and (L)
real values of constants in the least significant bit.
The potential difference is in the last digit of the mantissa and in most cases therefore only has
a slight effect on the accuracy.
If you evaluate the last digit of the mantissa, the semantics of your STEP 7 program may
change after the conversion.

"ST" parameter for IEC timers

The "ST" parameter of an IEC timer is used internally and it is prohibited to write it. This why this
parameter is no longer visible as of TIA Portal V14. If you have write access in your program to
the "ST" parameter, an error message is generated during compiling after the upgrade.
If you exchange data with Inter Project Engineering and you have access to the "ST" parameter
with HMI, you must first export the project and then re-import it into the proxy CPU. Only then
does the "ST" parameter disappear in the HMI configuration.

Associated values for messages (S7-1500)

Projects created with an older version of the TIA Portal can contain embedded associated
values with different structures in the different project languages. The associated values may
have a different order or may be missing in a different language. When a project of this type is
upgraded, the order of the associated values is harmonized. It is based on the reference
language set in the original project. In this case, it is recommended to have the translated texts
checked and corrected.

Implicit data type conversion for block parameters of the "DB_ANY" data type
When accessing a block parameter of the "DB_ANY" data type with the syntax
DB_ANY.%DB(B|W|D), no implicit data type conversion was performed previously. The bit
pattern of the source value was simply converted into the target data type. If the target data type
was smaller than the source data type, an overflow occurred and the written value may have
been wrong or inaccurate. The enable output ENO is not set to "FALSE" when accuracy is lost
or runtime errors occur.
As of V14, conversion is performed according to the rules of implicit data type conversion when
parameters are passed with the syntax DB_ANY.%DB(B|W|D). Note that after the upgrade a
different value may be written and the semantics of your program may change. In addition, the
enable output ENO is set to "FALSE" when a runtime error occurs.

Readme
58 Programming and Operating Manual, 11/2019
 STEP 7
2.5 Programming a PLC

Interface of organization blocks with standard access

The interface of organization blocks with standard access must have a minimum size of 20
bytes. In older versions of TIA Portal, only the interface of OB1 was checked with regard to the
minimum size during the compilation run. As of V14, interfaces of all organization blocks are
checked. You may now receive an error message during the compiling of a program that has
been compiled without errors up to this point.

Comparing tags of WORD data type to tags of the S5TIME data type (S7-1500)
As of TIA Portal V14, both variables are converted to the TIME data type when comparing a
variable of WORD data type to a variable of S5TIME data type. The WORD tag is interpreted
as an S5TIME value. If one of the variables cannot be converted, the comparison is not
performed and the result is FALSE. After successful conversion, the comparison is performed
based on the selected comparison expression.

[Link] Compatibility of PLC programs from versions prior to V13 SP1

Content
Information that could not be included in the online help and important information about
product characteristics.

Compatibility
You can continue to use in V13 SP1 all programs that were created with TIA Portal V12 SP1 or
V13. However, because improvements were made to the compiler and errors corrected there
(compilation of the program code) in V13 SP1, it can occur in rare cases that the program reacts
differently after the upgrade or that you have to adjust the program code manually. These cases
are described in detail below.

Unused bits of PLC data types (UDT) with firmware >= V1.8.1
The unused bits of PLC data types in standard memory areas are occupied or overwritten, for
example, for a PLC data type that contains 4 bits.
With firmware versions < V1.8.1, you could not use the unused bits of a PLC data type
elsewhere.
With firmware version >= V1.8.1, all bits are occupied or overwritten even if only 4 bits are used.

Note
Address assignments
Ensure you do not assign the same absolute address twice to different symbolic address
assignments.

Readme
Programming and Operating Manual, 11/2019 59
STEP 7
2.5 Programming a PLC

Explicit data type conversion in SCL (S7-1200) with firmware >= V4.2
With firmware versions < V4.2, the string was transferred aligned to the right and filled with
leading spaces during explicit data type conversion of SINT/INT/DINT/REAL_TO_STRING/
WSTRING in SCL.
Example: REAL_TO_WSTRING(12) = ' 1.200000E+1'
As of TIA Portal V13, the string is displayed with a leading sign during explicit data type
conversion of SINT/INT/DINT/REAL_TO_STRING/WSTRING in SCL and transferred aligned
to the left.
Example: REAL_TO_WSTRING(12) = '+1.200000E+1'

Reading an invalid peripheral input

In the TIA Portal as of version 12, the error code 16#2942 for the reading of an invalid peripheral
input is only output if you have programmed the faulty access in such a way that this becomes
effective, for example %MW10 := “InvalidWordAccess":P, and does not lie within an irrelevant
sequence. For example, this would be #tmp := “InvalidWordAccess":P, if the tag #tmp is not
used in the rest of the program block.

Instruction "S_CONV: Convert character string"

The EN/ENO mechanism behaves differently in TIA Portal V13 SP1 than in TIA Portal V13.
In version V13, the ENO enable output returns the signal state "0" in case of error, even if you
have deactivated the ENO enable output. If you have switched an additional instruction to the
ENO enable output, this is then not executed.
In version V13 SP1, the ENO enable output returns the signal state "1" in case of error, if you
have deactivated the ENO enable output. If you have switched an additional instruction to the
ENO enable output, this is then executed as expected.

Instruction "SET: Set bit array" (S7-300/S7-400)

In the TIA Portal, you can also interconnect an element of a data block at the N parameter of
the SET instruction.

Instruction "MUX: Multiplex" (SCL)

Up to and including TIA Portal V13, the value of the tag at the input parameter was output
unchanged as a function value, even if the K parameter had a negative integer. This behavior
has changed in TIA Portal V13 SP1.
In TIA Portal V13 SP1, if you use a tag with a valid data type at the input parameters of the MUX
instruction and the K parameter is a negative integer, the value of the tag is changed. You can
find the valid data types in the description of the MUX instruction in the information system.

Readme
60 Programming and Operating Manual, 11/2019
 STEP 7
2.5 Programming a PLC

Instruction "DEMUX: Demultiplex" (SCL)

Up to and including TIA Portal V13, no value was output at the OUTELSE output parameter if
the value of the K parameter was < 0. In contrast, the value of the IN input parameter was output
at the OUTELSE output parameter if the value of the K parameter was > available outputs. This
behavior has changed in TIA Portal V13 SP1.

In the TIA Portal V13 SP1, if you specify at the K parameter a value that is outside the available
outputs (K < 0 or K > available outputs), then the value of the IN input parameter is output at the
OUTELSE output parameter.

Instruction "MOVE: Move value" (STL) (S7-1500)

As of the TIA Portal V13 SP1, a stricter syntax rule applies to the "MOVE" instruction in STL:
Up to and including TIA Portal V13. it was possible to specify non-typed constants, such as "0"
at the input parameter IN.
If you want to copy, for example, the value "0" in the TIA Portal V13 SP1, you need to specify
a typed constant according to the data type of the output parameter (e.g. INT#0, DINT#0, etc.).

Instruction "Program_Alarm: Generate program alarm with associated values" (S7-1500)

As of TIA Portal V13 SP1 the data type INT is no longer permitted for use for the associated
values or an index tag of a text list. Use the UINT data type instead.

Instructions "READ_DBL: Read from data block in the load memory" and "WRIT_DBL: Write to data
block in the load memory"
TIA Portal V13 SP1 reports a compilation error if you use "READ_DBL" V1.0 or "WRIT_DBL"
V1.0 and access a data block with the attribute "Only store in load memory" using the parameter
DSTBLK.
Instead, use version 1.2 of both instructions.

"READ_DBL instructions: Read from data block in the load memory" and "WRIT_DBL: Write to data
block in the load memory" (SCL)
As of TIA Portal V13 SP1, the "READ_DBL" and "WRIT_DBL" instruction in SCL are subject to
the same strict syntax rules as all other programming languages:
In TIA Portal V13, it was possible to specify "standard" data blocks at the SRCBLK and
DSTBLK parameters that contained tags with different data types.
As of TIA Portal V13 SP1, the individual tags contained must have the same data type for both
"standard" as well as for "optimized" data blocks; otherwise, compiling errors are reported.

Function values (Return)

As of TIA Portal V13 SP1, more stringent syntax rules apply to function call:

Readme
Programming and Operating Manual, 11/2019 61
STEP 7
2.5 Programming a PLC

It is checked that the function value (Return) is written in any case, even if multiple possible
program paths can be run through in the function. Therefore, there is no longer any risk that the
function values will accidentally not be written during runtime.
However, you may possibly receive syntax errors in functions during compiling, which it was still
possible to compile without errors in V13. In such cases change the program code so that the
function valve is written in all possible program paths.
Example:

SCL
IF #MyIn1 = #MyIn2 THEN
#Block_3 := #MyIn1 + 1;
END_IF;

In this example, the function value of "Block_3" is not written if the condition of the IF instruction
is not fulfilled. The function value then contains an undefined value.

SCL
#Block_3 := #MyIn1;
IF #MyIn1 = #MyIn2 THEN
#Block_3 := #MyIn1 + 1;
END_IF;

In this example the function valve of "Block_3" is definitely written in the program, since "MyIn1"
is set as default before the IF loop is completed.

Comparing the hardware data types HW_IO and HW_DEVICE

As of TIA Portal V13 SP1, there is a stricter syntax rule that is valid for the comparison of the
data types HW_IO and HW_DEVICE:
Up until and including TIA Portal V13 it was possible to compare the data types HW_IO and
HW_DEVICE directly with each other.
If you want to compare these data types in TIA Portal V13 SP1 you have to first create a tag of
the data type HW_ANY in the section "Temp" for the block interface and then copy the LADDR
(from data type HW_DEVICE) to the tag. It is then possible to compare HW_ANY and HW_IO.

Implicit conversion of floating-point numbers to DWORD (GRAPH) (S7-1500)

As of TIA Portal V13 SP1 stricter syntax rules apply for the implicit conversion of floating-point
numbers to DWORD:
Up to and including TIA Portal V13, it was possible to convert a non-typed constant (e.g. 1.0)
implicitly to the data type DWORD if the value was less than 32 bits.
With TIA Portal V13 SP1, if you want to convert a floating-point number implicitly to the data
type DWORD, you can only use typed constants (e.g. REAL#1.0) since a non-typed constant
(e.g. 1.0) is interpreted as data type LREAL and can no longer be converted implicitly to
DWORD.

Readme
62 Programming and Operating Manual, 11/2019
 STEP 7
2.5 Programming a PLC

Assigning a value to a LTIME constant (S7-1500)

As of the TIA Portal V13 SP1, a stricter syntax rule applies to the definition of a value to a LTIME
constant:

Up until and including TIA Portal V13 it was possible to assign a TIME value (e.g. T#10s) to a
LTIME constant.

If you want to assign a value to a LTIME constant in TIA Portal V13 SP1, you have to use LTIME
syntax (e.g. LT#10s).
Please note that the corresponding TIA Portal projects from previous versions already had to
have been adjusted before the upgrade to TIA Portal V13 SP1.

Indirect indexing of ARRAY components of data type bit string in SCL (S7-1200/S7-1500)
In TIA Portal V13, you can address the components of an ARRAY for a CPU of the
S7-1200/1500 series in SCL with a tag of the data type BYTE, WORD, DWORD or LWORD as
index in addition to a tag of the integer data type if the IEC check is not set. This is not possible
for a CPU of the S7-300/400 series.
The result is an incompatibility with TIA Portal V12 SP1 in which indirect indexing with the data
type bit string is also permitted on a CPU of the S7-300/400 series.

EN/ENO mechanism for STRING conversion (S7-1200/S7-1500)

Conversion Description
Strg_TO_Chars: Convert character string to Array The ENO enable output returns the signal state "0"
of CHAR even if you have deactivated the ENO enable out‐
put:
● For an invalid character at the CHARS
parameter
● For an invalid ARRAY index at the PCHARS
parameter
● If the sum of the PCHARS and STRG
parameters exceeds the length of the target
ARRAY.
Chars_TO_Strg: Convert Array of CHAR to char‐ The ENO enable output returns the signal state "0"
acter string even if you have deactivated the ENO enable out‐
put:
● If the sum of the PCHARS and CNT
parameters exceeds the length of the source
ARRAY.

Overflow of the local data stack (S7-300/S7-400)

As of TIA Portal V13 SP1, the size of the local data stack is checked to ensure it does not
exceed what you have defined for the OB priorities in the hardware configuration.

Readme
Programming and Operating Manual, 11/2019 63
STEP 7
2.5 Programming a PLC

This means that you may get error messages during compilation in projects that could be
compiled without errors in V13. If this happens, change the maximum size of the local data
stack in the hardware configuration.

Readme
64 Programming and Operating Manual, 11/2019
 STEP 7
2.6 Inter Project Engineering (IPE)

2.6 Inter Project Engineering (IPE)

2.6.1 Notes on IPE

Contents
Information that could not be included in the online help and important information about
product characteristics.

Using system diagnostics in the device proxy

To use the "system diagnostics" function in an IPE device proxy, for example, a system
diagnostics view, insert the PLC alarms as content of a device proxy.

Connections to the SIMATIC S7-1500 software controller

Connections to the SIMATIC S7-1500 software controller as device proxy are only possible via
the interfaces assigned to the software PLC.

Support of Alarm_S alarms

The integrated configuration with WinCC and SIMATIC Manager support the Alarm_S alarms,
which are available via data blocks and Continuous Function Chart (CFC).

Compatibility
With TIA Portal V15.1, you can open the IPE files of the same version and earlier versions from
V13 SP1.
IPE files created with TIA Portal version V15.1 cannot be opened with earlier versions.

Readme
Programming and Operating Manual, 11/2019 65
STEP 7
2.7 Technological functions

2.7 Technological functions

2.7.1 Notes on S7-1500 Motion Control

Technology alarms 900-902

Contrary to the documented behavior, the received leading value is detected as invalid with
technology alarms 900 and 901 as alarm response. Technology alarm 902 has no alarm
response.
The technology alarms 900 and 901 are displayed in the diagnostics buffer.

No. Response Error bit Warning bit Restart Diagnos‐ Alarm text
tics buffer
900 Set invalid leading value X2 - - X Invalid leading values.
901 Set invalid leading value X2 - - X Data transmission error.
902 No response - X2 - - Accuracy of leading value is limited.

You can acknowledge a technology alarm 900 with an "MC_Reset" job with "Restart" = FALSE.
A restart is not required.
The technology alarm 900 is displayed with the following alarm text:

Alarm text Solution

Invalid leading values. Set a higher tolerance time (<TO>.[Link]‐
valid).
Check the connection of the interconnected components. Make sure that there is no
communication interference.
Make sure that the CPUs involved are in RUN operating state.

The technology alarm 901 is displayed with the following alarm text:

Alarm text Solution

Data transmission error
Invalid version Check the communication.
Invalid modulo start value
Invalid modulo length
Sign-of-life error
Invalid position Check the leading value of the leading axis on the other CPU.
Invalid velocity
Invalid acceleration

Upgrading projects in TIA Portal version V16

Due to changes in the project storage format in TIA Portal version V16, a conversion of existing
projects is necessary. Depending on the size of the project, a conversion can take a long time.
The total duration of the conversion can take between several minutes to over an hour.

Readme
66 Programming and Operating Manual, 11/2019
 STEP 7
2.7 Technological functions

Behavior of the modulo cycle counter when homing with "MC_Home"

In contrast to the documented behavior, the modulo cycle counter responds during direct
relative homing with "Mode" = 1, 12 and with absolute value encoder calibration (relative) with
"Mode" = 6 as with direct absolute homing with "Mode" = 0. The counter values of the modulo
cycles change during homing and the absolute encoder calibration with the listed modes as
follows:

Action Description
Absolute value calibration with The modulo value is the shortest distance between the current and new position. De‐
"Mode" = 6 pending on the distance, the modulo cycle counter can remain the same, increase by
1 or decrease by 1.
Direct homing relative with "Mode" The modulo value is the shortest distance between the current and new position. De‐
= 1, 12 pending on the distance, the modulo cycle counter can remain the same, increase by
1 or decrease by 1.

Use of the "DX_TEL_SyncOp" data type for cross-PLC synchronous operation

Output and input tags with the "DX_TEL_SyncOp" data type are created for the cross-PLC
synchronous operation at the start address of the transfer area. If the data type
"DX_TEL_SyncOp" cannot be assigned, it was deleted with the last compilation.
Unused data types are deleted during the compilation. To restore the "DX_TEL_SyncOp" data
type, add a V5.0 technology object. After using the data type in the PLC tag, the technology
object can be deleted again

Manually configuring delay times on the leading axis and the virtual following axis
If you increase the delay time of the leading axis in the leading value settings, this results in a
reduction of the extrapolation time at the leading axis proxy or to an increase of the interpolation
time of the distributed leading value at the leading axis proxy. This reduces the error resulting
from extrapolation in the acceleration and delay phases of the leading value.
If the delay time at the leading axis proxy is increased, this results in an increase of the
extrapolation time or to a reduction of the interpolation time.

Calculation of the following error

The following error is the difference between the setpoint and actual position based on the
connection of the axis at the drive. In contrast to the documented behavior, the transmission
times of the setpoints from the controller to the drive and the position values from the drive to
the controller are not part of the following error. The value of the following error is thus not the
same as the difference between the setpoint available in the controller minus the existing actual
position.

Performance of the user transformation with dynamic adaptation (S7-1500T)

With the Technology Version V5.0, longer runtimes of the MC-Interpolator [OB92] arise with the
user transformation. With longer runtimes of the MC-Interpolator [OB92] the runtimes of the
organization blocks with lower priority are extended.

Readme
Programming and Operating Manual, 11/2019 67
STEP 7
2.7 Technological functions

The maximum bandwidth of the CPU is limited for records with kinematics trace (S7-1500T)
For violations of the maximum bandwidth, not all signals of a record can be recorded and
evaluated with kinematics trace.
Consider the system limits of the CPU (maximum 16 signals)
For different objects, the following signals are required:

Object Signals used

TCP and kinematics (depending on kinematics) 4-8
TCP (depending on kinematics) 2-4
OCS 1 (depending on kinematics) 2-6
OCS 2 (depending on kinematics) 2-6
OCS 3 (depending on kinematics) 2-6

Deactivate active signals under "Technology object > Kinematics trace > Configuration >
Records".

Blending between path motions and synchronous "point-to-point" motions (sPTP motions) (S7-1500T)
When using blending from a path motion to an sPTP motion, there might not be any blending
or the blending segment could be significantly shortened.
When using blending of path motions and sPTP motions, set the path dynamics as high as
possible.
● Jerk
● Acceleration

Changing the override for synchronous "Point-to-point" motions (sPTP motion) (S7-1500T)
When changing the override, the path of the motion of the tool center point (TCP) can change
an sPTP motion.
If the motion contour of the TCP is to be retained, proceed with kinematics with minimal change
to the override.

Use of blending with kinematics motions (S7-1500T)

Dynamic overruns on the kinematics axes might occur during blending.

Use of the "MC_TrackConveyorBelt" Motion Control instruction with the technology version V5.0
(S7-1500T)
Use of the "MC_TrackConveyorBelt" Motion Control instruction is not possible with the
technology version V5.0.

Readme
68 Programming and Operating Manual, 11/2019
 STEP 7
2.7 Technological functions

2.7.2 Notes on additional technology functions

Parameters of the technology objects in TIA Portal Openness

You can find a list of the available technology object parameters in the product information
"Parameters of the technology objects in TIA Portal Openness" on the internet (https://
[Link]/cs/ww/en/view/109744932).

S_USSI on S7‑1500
Note the following when using the instruction S_USSI of the distributed I/O ET 200S 1SI on an
S7‑1500.
The parameter ANZ shows the value 0 even in the case of an error.
If the CPU is switched to stop with the S_USSI instruction, check all possible errors listed at the
parameter ANZ.

PtP module with CM 1243-5 PROFIBUS Master

You have to make the following settings in the instance DB of the instructions when using the
PtP modules CM PtP RS232 BA, CM PtP RS422/485 BA, CM PtP RS232 HF, CM PtP
RS422/485 HF and CM PtP with a CM 1243-5 PROFIBUS Master with firmware ≤ V1.3.4:
● Send_P2P
max_record_len = 240
● Modbus_Master
Send_P2P.max_record_len = 240
● Modbus_Slave
Send_P2P.max_record_len = 240

PID_Temp on CPU 1500 V1.7

Note the following when using PID_Temp on a CPU 1500 with firmware version V1.7:
● The integrated dead zone in PID_Temp must not be used on CPU 1500 V1.7.
Do not change the preset 0.0 of the associated parameters
[Link] and [Link].
● If the cooling output is active (PidOutputSum < 0.0, OutputCool <> 0.0) for a closed loop
controller with active cooling and PID parameter switchover ([Link] =
TRUE, [Link] = TRUE) while "Pretuning cooling" is started (Mode = 1,
[Link] = FALSE, [Link] = TRUE), aborts with error ErrorBits =
16#0040_0000.
– In this case use "Fine tuning cooling" (Mode = 2, [Link] = FALSE,
[Link] = TRUE)
or
– Before starting the pretuning, switch to manual mode with a manual value larger than 0.0
(Mode = 4, ManualValue ≥ 0.0).

Readme
Programming and Operating Manual, 11/2019 69
STEP 7
2.7 Technological functions

As of firmware version V1.8, these two restrictions no longer apply.

2.7.3 Notes on technological functions

Automatically apply drive or encoder values during configuration (offline)

Not all configuration parameters are automatically applied when connecting a SINAMICS V90
PN via HSP. Deactivate the "Automatically apply drive values during configuration (offline)"
option and apply the configuration parameters of the drive and encoder manually in the
configuration of the technology object.

ErrorID 16#820D

ErrorID ErrorInfo Description Solution

16#820D Technology object is in restart
16#0001 - Acknowledge error with instruction "MC_Reset" and restart
the job, if necessary

PtP module with CM 1243-5 PROFIBUS Master

You have to make the following settings in the instance DB of the instructions when using the
PtP modules CM PtP RS232 BA, CM PtP RS422/485 BA, CM PtP RS232 HF, CM PtP
RS422/485 HF and CM PtP with a CM 1243-5 PROFIBUS Master with firmware ≤ V1.3.4:
● Send_P2P
max_record_len = 240
● Modbus_Master
Send_P2P.max_record_len = 240
● Modbus_Slave
Send_P2P.max_record_len = 240

2.7.4 Notes on technological functions

Parameter assignment for the FM x51 and FM x52

In contrast to the information in the Online Help, if you change the measuring system, the
previously entered parameter values are not converted to the new measuring system.

Programming FM x50-1, FM x51 and FM x52

The "initial values" specified in the parameter tables in the online help regarding the instructions
correspond to the "default value" in the software interface of the user programming.

Readme
70 Programming and Operating Manual, 11/2019
 STEP 7
2.7 Technological functions

IM 174 migration
During the migration of projects with IM 174, the parameter assignment of IM 174 is set to
default values. It is absolutely necessary to set parameters for IM 174 again after the migration.

2.7.5 SIMATIC STEP 7 Easy Motion Control

[Link] Notes on SIMATIC STEP 7 Easy Motion Control

There are no notes available on SIMATIC STEP 7 Easy Motion Control.

2.7.6 SIMATIC STEP 7 PID Professional

[Link] Notes on SIMATIC STEP 7 PID Professional

There are no notes available on SIMATIC STEP 7 PID Professional.

Readme
Programming and Operating Manual, 11/2019 71
STEP 7
2.7 Technological functions

Readme
72 Programming and Operating Manual, 11/2019
WinCC 3
3.1 Security information

Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
security concept. Siemens’ products and solutions only form one element of such a concept.
Customer is responsible to prevent unauthorized access to its plants, systems, machines and
networks. Systems, machines and components should only be connected to the enterprise
network or the internet if and to the extent necessary and with appropriate security measures
(e.g. use of firewalls and network segmentation) in place.
Additionally, Siemens’ guidance on appropriate security measures should be taken into
account. For more information about industrial security, please visit
[Link] ([Link]
global/en/industrial-security/Pages/[Link])
Siemens’ products and solutions undergo continuous development to make them more secure.
Siemens strongly recommends to apply product updates as soon as available and to always
use the latest product versions. Use of product versions that are no longer supported, and
failure to apply latest updates may increase customer’s exposure to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS
Feed under
[Link] ([Link]
global/en/industrial-security/Pages/[Link])

Passwords
Various passwords are set by default in WinCC. For security reasons, you should change these
passwords.
● For HMI devices with version 12, the default password for the Sm@rtServer and for the
integrated Web server is "100". A default password is not preset for HMI devices with
version V13.
● For the user "Administrator", the default password is "administrator".

Integrated Web server

It is always possible on a PC to access HTML pages in runtime, although the option "HTML
pages" is deactivated. Setup always installs the standard pages of the Web Server on the PC.
Assign an administrator password to prevent unauthorized access to the pages.

Readme
Programming and Operating Manual, 11/2019 73
WinCC
3.1 Security information

Communication via Ethernet

In Ethernet-based communication, end users themselves are responsible for the security of
their data network. The proper functioning of the device cannot be guaranteed in all
circumstances; targeted attacks, for example, can lead to overload of the device.

Use of SSL 3.0

For security reasons, the use of the protocol SSL 3.0 is not recommended on Comfort Panels
or in Runtime Advanced. The use of the protocol SSL 3.0 is disabled by default on Comfort
Panels. If you nevertheless wish to activate the use of SSL 3.0, select the following in Internet
Explorer or in "Start Center > Settings: Internet Options > Advanced > Use SSL 3.0".
For RT Advanced, the use of SSL 3.0 can be disabled in Internet Explorer or in the Control
Panel under "Internet Options > Advanced" by deactivating the "Use SSL 3.0" option.

Network settings
The following tables show the network settings of each product which you need in order to
analyze the network security and for the configuration of external firewalls:

WinCC Professional (without simulation)

Name Port num‐ Transport Direction Function Description
ber protocol
ALM 4410* TCP Inbound, License service This service provides the complete functionali‐
Outbound ty for software licenses and is used by both the
Automation License Manager as well as all li‐
cense-related software products.
HMI Load 1033 TCP Outbound HMI Load (RT This service is used to transmit images and
Basic) configuration data to Basic Panels.
HMI Load 2308 TCP Outbound HMI Load This service is used to transmit images and
(RT Advanced) configuration data to panels.
RPC ** UDP Inbound, Client / server & This service is used by WinCC Professional
Outbound ES communica‐ and WinCC Runtime Professional.
tion (CCAgent)
* Default port that can be changed by user configuration
** Port is assigned automatically

WinCC Simulation for Basic Panels

Name Port num‐ Transport Direction Function Description
ber protocol
HMI Load 1033 TCP Inbound HMI Load This service is used to transmit images and
(RT Basic) configuration data to Basic Panels.
EtherNet/IP 44818 TCP Outbound Ethernet/IP The Ethernet/IP protocol is used for connec‐
channel tions to Allen Bradley PLCs.
2222 UDP Inbound Ethernet/IP The Ethernet/IP protocol is used for connec‐
channel tions to Allen Bradley PLCs.
Modbus TCP 502 TCP Outbound Modbus TCP The Modbus TCP protocol is used for connec‐
channel tions to Schneider PLCs.

Readme
74 Programming and Operating Manual, 11/2019
 WinCC
3.1 Security information

WinCC Simulation for Basic Panels

RFC 1006 102 TCP Outbound S7 channel Communication with the S7 controller via
Ethernet/PROFINET
Mitsubishi MC 5002 TCP Outbound Mitsubishi MC The Mitsubishi protocol is used for connections
channel to Mitsubishi PLCs.

WinCC Simulation for Panels and Runtime Advanced

Name Port num‐ Transport Direction Function Description
ber protocol
DCP --- Ethernet Outbound PROFINET The DCP protocol (Discovery and basic Con‐
figuration Protocol) is used by PROFINET and
provides the basic functionality for locating and
configuring PROFINET devices.
LLDP --- Ethernet Inbound, PROFINET The LLDP protocol (Link Layer Discover Proto‐
Outbound col) is used by PROFINET for topology detec‐
tion.
SMTP 25 TCP Outbound SMTP This service is used by WinCC Runtime Ad‐
Communication vanced to send e-mails.
HTTP 80* TCP Inbound HTTP channel The web server is only available when HTTP
server channel servers or HTML pages are activated
HTML pages The used port may differ depending on auto‐
matically selected settings.
RFC 1006 102 TCP Outbound S7 channel Communication with the S7 controller via
Ethernet/PROFINET
NTP 123 UDP Outbound Time synchroni‐ The NTP protocol (Network Time Protocol) is
zation used for time synchronization in IP-based net‐
works.
SNMP 161 UDP Outbound PROFINET The SNMP client functionality is used by STEP
7 to read status information from PROFINET
devices.
HMI Load 2308 TCP Outbound HMI Load This service is used to transmit images and
(RT Advanced) configuration data to panels.
HTTPS 443* TCP Inbound HTTP channel The web server with HTTPS protocol is only
server available when HTTP channel servers or
HTML pages HTML pages are activated. The used port may
differ depending on automatically selected set‐
tings.
VNC server 5900* TCP Inbound Sm@rtServer This service is only available when Sm@rtSer‐
vice is activated.
5800* TCP Inbound Sm@rtServer This service is only available when Sm@rtSer‐
vice is activated.
VNC client 5500 TCP Outbound Sm@rtServer This service is only available when Sm@rtSer‐
vice is activated.
* Default port that can be changed by user configuration

Readme
Programming and Operating Manual, 11/2019 75
WinCC
3.1 Security information

WinCC Simulation for Runtime Professional

Name Port num‐ Transport Direction Function Description
ber protocol
RPC ** UDP Inbound, Client / server & This service is used by WinCC Professional
Outbound ES communica‐ and WinCC RT Professional.
tion (CCAgent)
RPC ** UDP Inbound, Client / server This service is used by WinCC Runtime Pro‐
Outbound communication fessional.
(CCEServer /
CCEClient)
HTTP 80 TCP Inbound, Client / server This service is used by WinCC Runtime Pro‐
Outbound communication fessional.
(CCEServer /
CCEClient)
RFC 1006 102 TCP Outbound S7 channel Communication with the S7 controller via
Ethernet/PROFINET
OPC UA 4840 TCP Inbound OPC UA server This service is required for primary communi‐
cation via OPC UA. It is activated and config‐
ured during installation.
OPC UA discov‐ 52601 TCP Inbound OPC UA server This service provides information about the in‐
ery stalled OPC server. It is installed and config‐
ured by the OPC UA server.
DCOM 135 TCP Inbound OPC server This service is part of the Windows operating
system. Since communication via OPC (DA) is
based on DCOM, this service is required to in‐
itialize OPC (DA) connections.
DCOM ** TCP Inbound OPC server The communication via OPC (DA) is based on
DCOM and uses unspecified ports assigned by
the system. This should be taken into consid‐
eration when using OPC (DA) and creating
rules for the firewall.
HTTP 80 TCP Inbound OPC server This service is required for primary communi‐
cation via OPC XML. It is activated and config‐
ured during installation.
NetBIOS 137 UDP Inbound OPC server This service is part of the Windows operating
system. Access to this service is required by
OPC-Scout, for example, for browsing.
NetBIOS 138 UDP Inbound OPC server This service is part of the Windows operating
system. Access to this service is required by
OPC-Scout, for example, for browsing.
SNMP 161 UDP Outbound SNMP OPC This service is used by the SNMP OPC server
server to change or query data on network drives, for
example.
SNMP Traps 162 UDP Inbound SNMP OPC This service is used by the SNMP OPC server
server to query events from network drives, for exam‐
ple.
** Port is assigned automatically

Readme
76 Programming and Operating Manual, 11/2019
 WinCC
3.1 Security information

PROFINET protocols for Panels and Runtime Advanced

Name Port num‐ Transport Direction Function Description
ber protocol
DCP --- Ethernet Outbound Lifelist, The DCP protocol (Discovery and basic Con‐
PROFINET Dis‐ figuration Protocol) is used by PROFINET and
covery and con‐ provides the basic functionality for locating and
figuration configuring PROFINET devices.
LLDP --- Ethernet Inbound, PROFINET Link The LLDP protocol (Link Layer Discover Proto‐
Outbound Layer Discovery col) is used by PROFINET for topology detec‐
protocol tion.
MRP --- Ethernet Outbound PROFINET me‐ The MRP protocol (Medium redundancy proto‐
dium redundan‐ col) enables control of redundant transmission
cy paths using a ring topology.
PROFINET IO --- Ethernet Inbound, PROFINET Cy‐ Cyclic data exchange is used by panels for di‐
Data Outbound clic IO data rect keys and LEDs.
transfer
ARP --- Ethernet Inbound, Name Address This protocol is used to resolve network names
Outbound Resolution and assign IP addresses.
PROFINET Con‐ 34964 UDP Inbound, PROFINET con‐ The PROFINET Context Manager provides an
text Manager Outbound nection less endpoint mapper in order to establish an appli‐
RPC cation relation (PROFINET AR).

Communication connections for Panels and WinCC Runtime Advanced

Name Port num‐ Transport Direction Function Description
ber protocol
Telnet 23 TCP Inbound Telnet This service can be used for maintenance.
SMTP 25 TCP Outbound SendEMail This service is used by Windows CE / PC Run‐
time to send e-mails.
HTTP 80* TCP Inbound Hypertext The HTTP protocol is used for communication
Transfer Proto‐ with the HMI web server.
col
RFC 1006 102 TCP Outbound S7 channel Communication with the S7 controller via
Ethernet/PROFINET.
NTP 123 UDP Outbound Time synchroni‐ The NTP protocol (Network Time Protocol) is
zation used for time synchronization in IP-based net‐
works.
DCOM*** 135 TCP Inbound OPC server This service is a component of the Microsoft
Windows operating system. Communication
via OPC (DA) is based on DCOM. This service
is therefore required to initialize OPC (DA) con‐
nections.
DCOM*** ** TCP Inbound OPC server The communication via OPC (DA) is based on
DCOM and uses unspecified ports assigned by
the system. This should be taken into consid‐
eration when using OPC (DA) and creating
rules for the firewall.

Readme
Programming and Operating Manual, 11/2019 77
WinCC
3.1 Security information

Communication connections for Panels and WinCC Runtime Advanced

NetBIOS over 137 UDP Outbound With the use of Register / log on to a remote server.
TCP/IP Remote File
Share
NetBIOS over 138 UDP Outbound With the use of Register / log on to a remote server.
TCP/IP Remote File
Share
SNMP 161 UDP Outbound Simple Network The SNMP client functionality is used by STEP
Management 7 to read status information from PROFINET
Protocol devices.
HTTPS 443* TCP Inbound Secure Hyper‐ The HTTP protocol is used for communication
text Transfer with the HMI web server via Secure Socket
Protocol Layer (SSL).
Modbus TCP 502* TCP Outbound Modbus TCP The Modbus TCP protocol is used for connec‐
channel tions to Schneider PLCs.
Mitsubishi MC 1025* TCP Outbound Mitsubishi MC The Mitsubishi protocol is used for connections
channel to Mitsubishi PLCs.
Printing 1032 TCP Outbound Printing Printing on the control panel (via Ethernet).
HMI Load 2308 TCP Outbound Transfer This service is used to transmit images and
configuration data to panels. On Comfort Pan‐
els, this service has been replaced by Device‐
Manager and SCS as of V13. This service is
used to transmit configuration data to WinCC
Runtime Advanced.
HMI Load 50523 TCP Outbound Transfer This port is used if port 2308 is not available.
This service is used to transmit images and
configuration data to panels. On Comfort Pan‐
els, this service has been replaced by Device‐
Manager and SCS as of V13.
This service is used to transmit configuration
data to WinCC Runtime Advanced.
ALM 4410* TCP Inbound, Application Li‐ This service of RT Advanced makes available
Outbound cense Manager the complete functionalities for software licen‐
ses and is used by the Automation License
Manager.
OPC UA 4870* TCP Inbound OPC UA server This service is required for communication via
OPC UA.
HMI Load 5001 TCP Outbound Device Manager This service is used to transmit images and
Runtime to panels.
HMI Load 5002 TCP Outbound SCS (System This service is used to transmit configuration
Configuration data to panels.
Server)
VNC client 5500 TCP Outbound Sm@rtServer VNC client connection
VNC server 5800* TCP Inbound Sm@rtServer VNC server connection HTTP
5900* TCP Inbound Sm@rtServer VNC server connection
SIMATIC Logon 16389* TCP Outbound UMAC (User Register / log on to a remote server.
Management to
the Access Con‐
trol)
Allen Bradley 44818 TCP Outbound Ethernet/IP The Ethernet/IP protocol is used for connec‐
Ethernet IP channel tions to Allen Bradley PLCs.

Readme
78 Programming and Operating Manual, 11/2019
 WinCC
3.1 Security information

Communication connections for Panels and WinCC Runtime Advanced

Reserved 49152 ... TCP/UDP Outbound Dynamic port range is used, for example, to
65535 connect to the remote file sharing.
* Default port that can be changed by user configuration
** Port is assigned automatically.
*** Supported by WinCC Runtime Advanced only.

Readme
Programming and Operating Manual, 11/2019 79
WinCC
3.2 Data protection

3.2 Data protection

Siemens observes the data protection guidelines, especially the requirements regarding data
minimization (privacy by design). This means the following for this SIMATIC product: The
product does not process / save any personal information, but only technical functional data
(e.g. time stamps). If the user links this data to other data (e.g. shift plans) or if the user saves
personal information on the same medium (e.g. hard disk) and therefore creates a personal
reference in the process, the user has to ensure meeting the guidelines regarding data
protection.

Readme
80 Programming and Operating Manual, 11/2019
 WinCC
3.3 Notes on use

3.3 Notes on use

Contents
Information that could not be included in the online help and important information about
product features.

Change in response after upgrading

The new WinCC version contains new features and improvements as compared to the previous
version. The new version might therefore demonstrate slight differences in the names or the
response of properties and functions after the upgrade. Unlike in previous versions, the
standard properties of newly created objects can also be changed.
These differences in response can lead to errors when compiling the project.

Installation path
If you had the simulation installed in an earlier version, you cannot adjust the installation path
during the installation.

Working with standard user rights

If you are working with standard user rights in Windows 7, "User Account Control (UAC)" must
not be disabled.
The "User Account Control" is enabled in Windows 7 by default.
For more information on the "User Account Control", refer to the online help for Windows 7.

On-screen keyboard (RT Advanced)

Once you have opened TIA Portal, you can no longer access the on-screen keyboard.
To access the on-screen keyboard in Windows, use the following command: "Start > All
Programs > Accessories > Ease of Access > On-screen keyboard".

Device change – character sets (RT Professional)

If you have configured different fonts on screen objects for multilingual texts in the various
project languages, you should check the screens after an HMI device replacement from a panel
to a PC-based runtime. The configured fonts might change if the device is replaced.

Texts in the simulation (RT Professional)

If a runtime language which does not correspond to an installed product language is used in the
simulation, system texts are shown in an installed product language. Depending on the
operating system and the installed product languages, this will be either English or Chinese.

Readme
Programming and Operating Manual, 11/2019 81
WinCC
3.3 Notes on use

If you wish to see all texts in Japanese, Korean or Taiwanese in the relevant language in the
simulation, you should first install WinCC without simulation. Then install WinCC Runtime
Professional with the required languages.

Online delta loading with user-defined cycles (RT Professional)

If you have configured new custom cycles in the "Cycles" editor, "Load > Software (compile all)"
command when loading the project. Online delta loading is not possible.

License transfer via S7USB

You always need to run WinCC to transfer a license to a panel via S7USB.

Transferring licenses to a panel on 64-bit operating systems

If you are running a 64-bit operating system and the "Edit > Connect target systems > Connect
HMI device" menu command is not available in Automation License Manager, open command
line input and run the following command with administrator rights:
"%WINDIR%\system32\[Link]" "%CommonProgramFiles%\siemens\AlmPanelPlugin
\[Link]"

PostScript fonts
Only fonts that contain TrueType data can be used in TIA Portal. PostScript fonts and open type
fonts that contain PostScript data are not supported.

Tasks with tag trigger

A task with tag trigger is executed when the value of the internal tag is written, even if the value
of the internal tag does not change.

Readme
82 Programming and Operating Manual, 11/2019
 WinCC
3.4 Migration

3.4 Migration

Contents
Information that could not be included in the online help and important information about
product features.

Migrating a project created with WinCC V7

A prerequisite for the migration is that this project was processed with at least WinCC V7.5
Update 3.

Migrating an integrated project with ProTool objects

If you migrate a WinCC flexible project integrated in STEP 7 and the error message "PROTOOL
option package(s) missing in STEP 7" is output, you have installed WinCC flexible 2008 SP3
or later. Moreover, the project still contains objects that were configured using ProTool. Do not
open the project with WinCC flexible. To migrate the project, proceed as follows:
1. Open the project in the SIMATIC Manager.
2. Execute the "Save as" command in the "File" menu.
3. Enable the option "With reorganization" in the "Save project as" dialog.
4. Click OK.
5. Copy the project back to the original computer.
6. Restart the migration.

Progress bar
As long as the progress bar still shows a value of 100%, the software is still busy running
remaining tasks such as the closing of references. The software will not respond to user input
while this status is given.

Readme
Programming and Operating Manual, 11/2019 83
WinCC
3.5 Engineering System

3.5 Engineering System

3.5.1 Screens and Screen Objects

Contents
Information that could not be included in the online help and important information about
product features.

Screen objects after HMI device replacement

If you upgrade a device to the new HMI device versions, you should check the screens
contained in the project. Because of the new appearance and improved operability, texts of
symbolic I/O fields might not be completely legible and can be concealed by operator controls.

Grouping of screen objects

When you group screen objects in WinCC, performance problems can arise in WinCC in the
case of large nesting depths.

Many visually different screen objects

The use of screen objects with many visually different properties (e.g. many different styles)
can reduce performance in runtime and can increase the amount of available memory space
used. Avoid using, for example, very many different corner radii: 0 pixel, 1 pixel, 2 pixels, 3
pixels, etc.

Dynamization of grouped objects (RT Professional)

For groupings with multiple nestings (group in group, faceplate in group, group in faceplate,
etc.), only the events of the outermost group and the innermost objects can be used for
dynamization with system functions. System functions that are configured at events of the
lower-level group or lower-level faceplate are not executed.
The configuration of simultaneous motion animation of an object group within this group can be
executed in runtime in a way other that what is expected. Check the sequence of the execution
in runtime and adapt the configuration if necessary.

Dynamization of faceplates (RT Professional)

The dynamization of a faceplate instance with user data type connection is not intended, but
can be realized in certain scenarios using an auxiliary tag. Read the information about this in
FAQ 109766634 ([Link]

Readme
84 Programming and Operating Manual, 11/2019
 WinCC
3.5 Engineering System

Number of characters in text fields, lists and alarm texts

The number of characters that can be used in the text of a screen object is not constant. Control
instructions and formatting are taken into consideration when entering text data and the
maximum number of characters is reduced accordingly.

Transparency in WinCC as of V13

Transparent graphics can be displayed without any problems in runtime. This is true for all
Comfort Panels and WinCC Runtime Advanced as of version 13.0.
To use the transparency in a graphic view or in a graphic I/O field, the "Fill pattern" property
must be set to "Transparent" and the property "Use transparent color" must be disabled.

Displaying SIMOTION PLC websites in the HTML browser

If the SIMOTION PLC websites are not displayed correctly in the HTML browser, insert ""/
basic"" after the website URL to display the websites in basic mode.

Display differences between the configuration and the display on the HMI device
The display of the text configured in a screen object might be different on the HMI device due
to the display configuration. If you are using the options for automatic size adjustment in the
configuration, check the display on your HMI device in every language.
If texts that were configured with the "Fit object to contents" option cannot be displayed in full,
they are reduced slightly on the HMI device. If this reduction leads to a distorted display of texts,
disable the "Fit object to contents" option and expand the text with additional blanks. Optionally,
you can increase the width of the object or use a shorter formulation for the text.

GRAPH overview (RT Professional)

When upgrading to V14, the signature of the C function at the "Click" event is changed. The
propertyName parameter from the previous versions has been removed. Functions that access
this parameter are shown as faulty after the upgrade.

Updating faceplates with the UDTs of the type "IEC timer"

The "ST" element was automatically removed from the user-defined PLC data types (UDT) that
use the "IEC timer" data type. Adapt the faceplates containing these UDTs to a new version of
the UDT without an ST element.
A detailed description of this can be found in the FAQ with the entry ID "109740393" in the
SIMATIC Customer Online Support.

Higher-level controls with visibility animation

The higher-level configuration of table-based controls with visibility animation can lead to
problems for touch operation with devices using the operating system Windows CE/Embedded
Compact.

Readme
Programming and Operating Manual, 11/2019 85
WinCC
3.5 Engineering System

System diagnostics view: "HMI access" access protection

When using the "HMI access" protection level in conjunction with the SIMATIC S7-1200 PLC,
correct display of the diagnostic data can only be ensured as of firmware version 4.1.

Fonts in the header of window objects (Panels, Runtime Advanced)

The font that you configure in the runtime settings of the device is not used in the alarm window,
system diagnostics window and dialog headers.

Invalid graphic types in graphic lists after upgrading (Runtime Professional)

When you upgrade your project to TIA Portal version V16, invalid graphic types in the graphic
list result in compiling errors that were displayed as warnings in V14.
To avoid error messages during compiling, you need to correct the graphic type in the graphic
list if necessary.

Multilingual graphics in faceplates

In a faceplate, insert a graphic in a screen object. This graphic is used in all specified project
languages.
If you open the graphic using the shortcut menu command "Edit" with the option "Edit graphic
centrally", the graphic is changed only for the currently set project language after editing and
saving in an external editor, such as MS Paint. The change of the corresponding graphic is
visible in all objects that use this graphic.

Network changes in the PLC code view (RT Professional)

When a ProDiag alarm is pending, network changes in the PLC code view are updated in
runtime.
In order for network changes in the PLC code view to be displayed correctly for criteria analysis,
the message must be triggered again.

My controls
"My controls" might not be displayed correctly in the engineering system. However, they can be
configured without restrictions. There are also no restrictions for the representation and
operability in Runtime. If this control is based on OCX technology, a switch to .Net is
recommended.

Supported data types for animations

Integer and Boolean values are permissible as data types for animations within an image.

Readme
86 Programming and Operating Manual, 11/2019
 WinCC
3.5 Engineering System

3.5.2 Tags and connections

Contents
Information that could not be included in the online help and important information about
product features.

Multiplexing tags (Basic Panels)

If you multiplex a tag with an external tag on a Basic Panel, the address is read from the PLC
in runtime during the first read cycle. The value of the address read is not available until the
second read cycle.

Tags with symbolic addressing and "Char Array" data type (RT Professional)
Tags with symbolic addressing and the "WString" data type are not released for communication
of RT Professional and SIMATIC S7-1200 V3.

Length specification for tags of the "String" type (RT Professional)

The length specification for the internal HMI tags of the "String" type have no effect in the "Tag"
editor. If you want to limit the tag length of an input field or output field, for example, limit the
length using VB scripting or C scripting.

Tag of the "String" type for connections with SIMOTION PLCs (Panels, RT Advanced)
The length of the String tags must not exceed 210 characters for SIMOTION controllers.
It is possible to create a String tab with more than 210 character in the engineering system.
However, the tag in question is not written in Runtime. A message stating that the value limit is
outside the tag appears.
In this case, adjust the length of the String tag.

Tags under "Tag box ID" (Mobile Panel)

The tag that you configure under "Tag box ID" with "Runtime Settings > General" may only be
used in read-only mode.
No values may be written in this tag, however, they may be read in scripts, for example, or
output to screens.

Array elements in WinCC

If you have connected an HMI tag with an array from a STEP 7 data block which does not start
with a low limit of 0, the array elements are mapped in WinCC to the low limit of 0.
To ensure that you do not have to rethink between the STEP 7 indices and the WinCC indices
when accessing the individual array elements, the low limits of arrays should also start at 0 in
STEP 7.

Readme
Programming and Operating Manual, 11/2019 87
WinCC
3.5 Engineering System

Use of 64-bit data types

The use of 64-bit data types may result in a slight loss of accuracy as these data types are
mapped in the HMI channel to the data type Double. It is therefore possible that integer data
types are displayed with decimal places.

System diagnostics of PLCs in the R/H system in non-redundant mode

Two PLCs and two corresponding connections are configured in an R/H system. If the R/H
system is not in redundant mode, it may happen that the system diagnostics views of the
connections show different diagnostics status symbols for the same PLC.

3.5.3 Alarm system and alarm displays

Contents
Information that could not be included in the online help and important information about
product properties.

Boolean tags in alarm logs

Bool type tags are recognized as 0 and -1 in the alarm log. If you use a text list that is controlled
by a tag of the type Bool in an alarm log, then add the entry for the value -1 to the corresponding
text list.

PLC alarms
A PLC alarm is only visible in the "Alarms" editor of an HMI device if there is an instance data
block for this FB.

Controller alarms in runtime (WinCC Professional)

If you upgrade a project from versions V13SP1 or V13 SP2 to versions V14, V14 SP1, V15,
V15.1, V16, you need to compile the project and load it in the controller and HMI device.
Otherwise, the controller alarms are shown crossed out in the alarm view.

Copying projects with integrated connections

If you copy the devices with their integrated connections (between HMI devices and controllers)
from a project to a global library and insert it from there in a new project, then the information
about controller alarms can get lost on the HMI device. To avoid this loss of information, first
copy all controllers and only then all HMI devices to the new project.

Readme
88 Programming and Operating Manual, 11/2019
 WinCC
3.5 Engineering System

3.5.4 System functions and scripts

Contents
Information that could not be included in the online help and important information about
product features.

Scripts for service projects (RT Professional)

Since no interactive user is usually logged in service projects, C scripts and VB scripts lead to
problems in the following cases:
● When the scripts require interaction, for example, operator input.
● When the scripts show message boxes.
There is no common data area for C scripting in service mode. Thus, for example, no global C
variables can be exchanged between the "Scheduled tasks" and "Screens".

Simulation with script debugger

To start the "Simulation with script debugger" from TIA Portal, the registry key
HKEY_CLASSES_ROOT\CLSID
\{834128A2-51F4-11D0-8F20-00805F2CD064}\LocalServer32 must contain an entry
"(Default)" of the type "String", which contains the whole path of the default script debugger
"[Link]". The debugger can be connected to a simulation which is already running without
this registry key.

Trigger tags of user-defined functions (RT Professional)

If you have configured an HMI or PLC user data type on a screen, you cannot use the elements
of the user data type as trigger tags in newly created or changed user-defined user functions.

User-defined functions in faceplates

If you want to access tags in a faceplate with a user-defined function, you cannot dynamically
compose the name of the tag.

System functions of the bit processing (Mobile Panels and RT Advanced)

Because of events it is not possible to manipulate bit arrays. System functions, e.g. InvertBit,
SetBit etc., must not contain any elements of a bit array as argument.

Properties no longer used (Comfort Panels and RT Advanced)

In WinCC V13, many new visual properties have been introduced and many existing properties
have been harmonized.
In the course of revision of the object properties, some properties that could be used in VB
scripts in earlier versions of WinCC are no longer supported for use in WinCC V13. Scripts that

Readme
Programming and Operating Manual, 11/2019 89
WinCC
3.5 Engineering System

use properties that are no longer supported remain valid, but the relevant calls within the scripts
have no function. These limitations pertain exclusively to Comfort Panels and RT Advanced in
device version V13.0.
The following table shows the properties of screen objects that are no longer being used:

Property Screen object

BorderBrightColor3D Slider
BorderColor Text field, I/O field, symbolic I/O field,
date/time field
BorderInnerWidth3D Slider
BorderOuterWidth3D Slider
BorderShadeColor3D Slider
BorderStyle3D Text field, I/O field, button, symbolic I/O field, graphic I/O field,
date/time field, bar, switch
BorderWidth Text field, symbolic I/O field
CenterColor Gauge
DialColor Gauge
EdgeStyle Text field, I/O field

Transferring parameters to VBScripts (Panels and RT Advanced)

In WinCC, you can define whether the parameters of VB scripts "ByRef" (address of the
parameter) or "ByVal" (value of the parameter) are transferred.
Transferring the address of the parameter using "ByRef" (Call by Reference) is possible only
for the internal tags of the VB script. With HMI tags, the value of the parameter is always
transferred regardless of whether the parameter was defined as "ByRef" or as "ByVal".

Supply trend view by means of user-defined function

When you read values from a log with a VBS function to display them in a trend view, you must
ensure that the difference between the time stamps is greater than zero.

Maximum number of parameters (Panels and RT Advanced)

The maximum number of parameters of a global function is 8 for the type "sub" and 7 for the
type "func".

"ShowLogonDialog" system function (Panels and RT Advanced)

For Panels and Runtime Advanced, the "ShowLogonDialog" system function should not be
configured for the "Value change" event of a tag.

Readme
90 Programming and Operating Manual, 11/2019
 WinCC
3.5 Engineering System

See also
Debug ([Link]
Err ([Link]

3.5.5 Reports

Contents
Information that could not be included in the online help and important information about
product features.

Printing reports (Panels)

Depending on the printer used, the objects placed at the edge of the reports can be cut off
during printing.
Make sure that your report has a suitable size.

3.5.6 Recipes

Contents
Information that could not be included in the online help and important information about
product features.

Recipe synchronization (Basic Panels, Panels, Comfort Panels and RT Advanced)

When data record values are sent to the controller, the values are only validated if the "Manual
transfer of individually modified values (teach-in mode)" option is selected for the recipe under
"General > Synchronization > Settings".

3.5.7 User administration

Contents
Information that could not be included in the online help and important information about
product features.

UMAC domain user

In WinCC V16.0, only local UMAC users may be used, no UMAC domain users.

Readme
Programming and Operating Manual, 11/2019 91
WinCC
3.5 Engineering System

3.5.8 Communication

Contents
Information that could not be included in the online help and important information about
product features.

Establishing a connection to WinCC Runtime Advanced

Ensure that the device version configured in the Engineering System matches the installed
Runtime version; otherwise, communication when the project is loaded will not be established
or will be delayed.
If the device version does not match the installed Runtime version, you have the following
options:
1. Change the device version configured in the Engineering System.
2. Install the version of WinCC Runtime Advanced corresponding to the configured device
version.

Connection changing for non-integrated connections

If you want to change the communication from a non-integrated connection to another non-
integrated connection, for example from Omron to Mitsubishi, you must ensure that the data
types of the tags are also supported in the new connection.

Connection interruptions with Mitsubishi PLCs

After multiple connection interruptions, a situation might arise where all the connection
resources of the Mitsubishi PLC are in use and the connection can no longer be established.
We recommend that you check these connection resources in the PLC program of the
controller and enable them again.

Self-signed certificates (RT Professional)

Self-signed certificates are no longer supported.
If a self-signed certificate is detected on the server side, the authentication takes place via the
previously distributed PSK key (pre-shared key). If the PSK keys of the communication
partners do not match, no communication is established.

Readme
92 Programming and Operating Manual, 11/2019
 WinCC
3.5 Engineering System

Accuracy of the "DTL" data type

The "DTL" data type supports time information down to the nanosecond range. Because panels
only support time information down to the millisecond, the following restrictions arise when
used at the area pointers:
● Area pointer "Date/time"
For the transmission of time information from a panel to the PLC, the smallest unit of time
is 1 millisecond. The value range from microseconds to nanoseconds of the "DTL" data type
is filled with zeros.
● Area pointer "Date/time PLC"
For the transmission of time information from a PLC to a panel, the range from
microseconds to nanoseconds is ignored. The time information down to and including
milliseconds continues to be processed on the panel.

Limited number of possible HMI connections

An error message is displayed during compilation of a device indicating that the configuration
of the HMI connection in the "Devices & Networks" editor is invalid. The reason might be that
the maximum number of possible connections of the HMI device or PLC has been exceeded.
Check the maximum number of available connections. Consult the device manuals of the
devices you are using.

Use of PROFINET IO with panel HMI devices

When using PROFINET IO to connect the direct keys and LEDs of HMI devices to the PLC, you
can define an offset for the address area of the inputs and outputs during configuration in HW
Config.
The following restriction applies when a PROFINET IO-capable S7-400 CPU is used with one
of the HMI devices listed below:
The offset for the start of the address area of the inputs must not be greater than the offset for
the start of the address area of the outputs.
The restriction applies to the following HMI devices:
● Mobile Panel 177
To configure the address parameters, open the PLC that contains the CPU of the 400 series in
HW Config. Select the HMI device that is connected via PROFINET IO from the station window
of HW Config. A table with the properties of the HMI device is displayed at the bottom of the
station window in the detail view. Select the line containing the addresses of the HMI device in
the table and open the object properties using the shortcut menu.
Enable the "Addresses" tab in the "Object properties" dialog. Configure the offset for the inputs
under "Inputs > Start". Configure the offset for the outputs under "Outputs > Start".

RT Advanced communication via Station Manager (SIMATIC NET) with an S7-1200

For communication of a SIMATIC S7-1200 with a PC with WinCC RT Advanced via a router,
the following restrictions apply to the PC:
● Windows 7: Only with installed SIMATIC NET 8.1

Readme
Programming and Operating Manual, 11/2019 93
WinCC
3.5 Engineering System

These restrictions also apply when you use the Station Manager. Connections with the help of
the Station Manager of Runtime Advanced are always treated as routed connections.

Changing the IP settings and device name of a PLC in the Control Panel of the HMI device (Basic Panels)
The Control Panel is open in the "Service and Commissoning > IP-Adaptation" menu on the
HMI device. If you want to change the IP settings or the device name of a PLC, note:
In the Engineering System, you need to have selected the following options in the Inspector
window of the PLC under "Properties > General > PROFINET interface > Ethernet addresses":
● "Set IP address using a different method"
● "Set PROFINET device name using a different method"

"Set the IP suite (address) of the PLC in the Control Panel" with SIMATIC S7-1200 V1 (Basic Panels)
The function "Set the IP suite (address) of the PLC in the Control Panel" has not been approved
for the following PLCs:
● SIMATIC S7-1200 V1

Connections via PROFIBUS DP

When a connection between a PLC and an HMI device via PROFIBUS DP is interrupted and
then re-established, sporadically all other PROFIBUS DP connections in the communication
network are interrupted and re-established.
De-energize the disconnected station before reconnecting it.

Switching a connection
A connection can be interrupted when it is switched from an HMI device to a SIMATIC
S7-300/400, SIMATIC S7-1500 or SIMATIC S7-1200 controller.
Note the following settings in the SIMATIC S7-1500 or SIMATIC S7-1200 PLCs:
● Absolute addressing of tags
● The "Disable PUT-GET communication" option must be selected
● The "Complete protection" protection level must not be set

Communication of Runtime Professional with SIMATIC S7-1200

In productive operation, communication of WinCC Runtime Professional with SIMATIC
S7-1200 is only released for single-station systems.

RT Advanced in the Station Manager

If RT Advanced and WinAC RTX use the same communication processor of a PC, HMI
communication with SIMATIC S7-1200 and SIMATIC S7-1500 is not possible.

Readme
94 Programming and Operating Manual, 11/2019
 WinCC
3.5 Engineering System

Raw data communication in redundant projects (RT Professional)

[Link], Named Connections and various communication blocks, such as BSEND/BRCV,
for example, can only be used to a limited extent in a redundantly configured PC station
because the connection parameters for the redundant partner server cannot be configured.

Non-integrated connection to a SIMATIC S7-1500 software PLC (RT Advanced)

A non-integrated connection between an HMI device and a SIMATIC S7-1500 software PLC is
not supported in WinCC.

Transfer areas of the operating mode IO device and DP slave of the HMI devices
If you have activated the operating mode "IO device" or "DP slave" for HMI devices, no transfer
areas should be added or deleted in the properties of the HMI device. If you have inadvertently
deleted or added a transfer area, disconnect and reconnect the controller.

Getting diagnostics data by means of HMI devices

In contrast to the description of diagnostics icons for modules and devices in the information
system, the following icon has the meaning specified here for HMI devices:

Icon Meaning
No diagnostics data is available.

PROFIenergy communication
To set up PROFIenergy communication, contact Customer Support.

Number of SmartClient connections

Even if the Basic Panel allows an unlimited number of SmartClient connections, configuring a
maximum of two connections is recommended. Any additional connection affects performance.

Readme
Programming and Operating Manual, 11/2019 95
WinCC
3.6 System-wide functions

3.6 System-wide functions

Contents
Information that could not be included in the online help and important information about
product features.

Using system diagnostics in the device proxy

To use the system diagnostics function in an IPE device proxy, for example, a system
diagnostics view, insert the PLC alarms as content of a device proxy.

Initialize the device proxy with data from a project of the previous version
A device proxy cannot be initialized with the data from a project of the associated full version
in a project with the Service Pack version.
Upgrade the source project to the Service Pack version to initialize the device proxy in the target
project with the data from the source project.

Import and export of library texts

The following objects are not supported when importing and exporting library texts:
● Import: Recipes, Recipe elements, Recipe data records, HMI alarms, Text list entries,
Screens, Reports.
● Export: Text list entries, Screens, Reports.
● Import and export of library type "Screen".

Readme
96 Programming and Operating Manual, 11/2019
 WinCC
3.7 Compiling and loading

3.7 Compiling and loading

Contents
Information that could not be included in the online help and important information about
product features.

Compiling and loading

If internal errors or warnings occur during compiling, compile the complete project using the
command "Compile > Software (rebuild all)" in the shortcut menu of the HMI device.
Before you start productive operation with your project, compile the entire project using the
"Compile > Software (rebuild all)" command from the shortcut menu of the HMI device.
If you are using HMI tags that are connected to control tags in your project, compile all modified
blocks with the command "Compile > Software" in the shortcut menu before you compile the
HMI device.

Checking the address parameters

When an HMI device is compiled in the project tree with the command "Compile > Hardware
and software (changes only)" in the shortcut menu, the address parameters of the HMI device,
such as the IP address, are not checked. If you want to ensure that the address parameters are
checked as well, you will have to compile the HMI device using the "Compile" button in the
"Devices & networks" editor of the toolbar.

Error message when downloading data to the PLC

A panel and a PLC are connected and communicating with other.
If a tag is accessed while downloading data from the panel to the PLC, an error message is
displayed on the panel.

Comfort panels as of device version 13.0: Backing up data while loading projects
If the transfer is interrupted for Comfort Panels with a device version 13.0 or higher, WinCC
automatically ensures that no data is lost and that existing data is only deleted on the HMI
device after complete transmission.

Displaying characters in transfer alarms

If characters are not displayed correctly in the transfer alarms during transfers to HMI devices
with the device version V12 or older, please check the region and language settings in
Windows. Set the corresponding language under "Language for non-Unicode programs".

Readme
Programming and Operating Manual, 11/2019 97
WinCC
3.7 Compiling and loading

Reducing the project size

When you compile your HMI device, an alarm appears informing you that the size of your
project is approaching the system limits for the corresponding HMI device. In this case, perform
a complete compilation of the software to reduce the project size. To do this, use the command
"Compile > Software (rebuild all)".

See also
Microsoft KB3083806 ([Link]

Readme
98 Programming and Operating Manual, 11/2019
 WinCC
3.8 Runtime

3.8 Runtime

3.8.1 Notes on operation in Runtime

Contents
Information that could not be included in the online help and important information about
product features.

Focus in runtime
If you have configured a low-contrast combination of focus color and border color for an HMI
device with version 12.0.0 or earlier, the focus may no longer be identifiable in runtime after you
change the device version in the TIA Portal. Change one of the two colors.

Language behavior - Layout of on-screen keyboard

The layout of the on-screen keyboard does not change when you switch to a runtime language
that is not installed for the keyboard layout.
In this case, the language setting for the keyboard remains set at the most recent valid
language or the language setting for the default keyboard layout of Windows is used.

Tag values exceed the maximum length

You enter a character string in a string tag via an I/O field. If the character string exceeds the
configured number of tags, the character string will be shortened to the configured length.

Empty alarm texts

Runtime is running with a project. The project is saved on a network drive.
In the event of interruptions to the network drive connection, Runtime may attempt to load alarm
texts from the network drive.
In the event of disconnection, the alarm window or the alarm view remains empty.
To avoid this, copy the project to a local drive before the starting the project in Runtime.

Duration of log initialization (Panels, RT Advanced)

Initialization of the logs on some storage media can take up to 5 minutes. The successful
completion of initialization is immediately confirmed by a system event. If there is no storage
medium for logging when runtime starts, the appearance of the system event can also take up
to 5 minutes.

Readme
Programming and Operating Manual, 11/2019 99
WinCC
3.8 Runtime

Large logs delay the ending of runtime (Basic Panels 2nd Generation)
When very large logs are used, ending runtime can take a long time. Use segmented logs as
an alternative to very large circular logs.

Slow reaction of SmartServer

The following programs may start and respond very slowly with Windows 7:
● HMI TouchInputPC
● SmartServer: <Ctrl+Alt+Del> shortcut in the logon dialog
The delay is caused by the callback for the Internet certificate validation.
Remedy:
You can find the following files on the product DVD under:
Support\Windows\CRL_Check or CD_RT\ Support\Windows7\CRL_Check\ :
● DisableCRLCheck_LocalSystem.cmd
● DisableCRLCheck_CurrentUser.cmd
1. Run the "DisableCRLCheck_LocalSystem.cmd" file with administrator rights. Select the
command "Run as administrator" from the shortcut menu of the file.
2. Reboot the PC.
If the problem persists, follow these steps:
1. Double-click the file and run the "DisableCRLCheck_CurrentUser.cmd" file with user rights.
2. Reboot the PC.
Note
The callback for the certificate validation is disabled for all users or PCs. To restore the
original state, perform the following files:
● RestoreDefaults_LocalSystem.cmd
● RestoreDefaults_CurrentUser.cmd
You can find the files in the following directory of the product DVD:
● Support\Windows\CRL_Check or CD_RT\Support\Windows7\CRL_Check\

Ending screensaver on the Sm@rtServer

When the screensaver is active on the Sm@rtServer on the server HMI device, you require
write access to the Sm@rtClient side in order to end the screensaver on the server HMI device.

Avoiding corrupt files during power failure

If a power failure occurs in Windows systems while the WinCC system is active, files may be
corrupt or destroyed. Operation with the NTFS file system provides better security.
Secure, continuous operation is only ensured by using an uninterruptible power supply (UPS).

Readme
100 Programming and Operating Manual, 11/2019
 WinCC
3.8 Runtime

Variable fonts on HMI devices

Windows 10 supports variable fonts ("OpenType Font Variations") since version 1709. You can
also use the variants of a variable font in the engineering system. The actual display in Runtime
depends on the HMI device and the installation conditions:
● Basic Panels, Comfort Panels: Variable fonts are not supported. The basic version is always
displayed.
● Runtime Advanced, Runtime Professional: Variable fonts are supported if at least Windows
10 Version 1709 is used as the operating system and the font is installed with administrator
rights.

3.8.2 Notes on operation of panels in Runtime

Contents
Information that could not be included in the online help and important information about
product features.

Using the mouse wheel in Runtime

The use of the mouse wheel in Runtime is not supported on all panels.

Backup on the memory card of the PLC (Basic Panels)

Create the backup file "[Link]" on the memory card of the PLC. An error, for example a
connection break, occurs when creating the backup.
This will create a corrupt file on the memory card of the PLC. Such a file has "~$" as prefix.
Delete the file with the prefix "~$" if you want to save a backup again under the same name
"[Link]".

Panel Data Storage and S7-1500F (Basic Panels)

The "Panel Data Storage" PDS function cannot be used on Basic Panels in conjunction with
S7-1500F when the password for the protection level "Full access incl. fail-safe" is used.

"Panel Data Storage" function (Basic Panels)

The "Panel Data Storage" (PDS) function provided by Basic Panels is only supported by
SIMATIC S7-1200 as of firmware V4.0 and SIMATIC S7-1500. For the PDS function, the panel
must be connected directly with the CPU and must not be connected via the CP.

Fonts with file extension ".ttx"

The fonts with the file extension ".ttx" are available on all panels and Runtime Advanced and
can be correctly displayed on all devices, for example, the "WinCC_flexible_smart" font.

Readme
Programming and Operating Manual, 11/2019 101
WinCC
3.8 Runtime

Mass data transfer with USB

If you have installed Windows 10 on the configuration PC, the "USB" transfer channel is not
available.
This restriction applies to the following devices and tools:
● Basic Panels: KP300 Basic, KP400 Basic, TP1500 Basic
● Mobile Panels: 170 series and 270 series
● WinCC Engineering System
● "ProSave" service tool

Note
The "USB" transfer channel remains available if Windows 7 is installed on the configuration PC.

Solution
Use other transfer channels to transfer the project data, such as the "Industrial Ethernet" or
"PROFIBUS DP" channel.

Modifying the IP address and device name for Panels

On Comfort Panels, the IP address or the device name can be modified even during runtime.
On Basic Panels, modification of the IP address or the device name during runtime is not
possible.

3.8.3 Notes on operation of Runtime Advanced

Contents
Information that could not be included in the online help and important information about
product features.

Starting runtime
Only WinCC Runtime V16 can be started from the Engineering System. Other versions of
WinCC Runtime can only be simulated.

Authorization for starting Runtime Advanced

On a computer running the Windows operating system, WinCC Runtime Advanced can only be
started if a user starting runtime is a member and has the rights of the group "Siemens TIA
Engineer".

Readme
102 Programming and Operating Manual, 11/2019
 WinCC
3.8 Runtime

Screen saver on computers with Windows 10

On a computer with Windows 10, an activated screen saver is no longer terminated when an
alarm of the "error" class is output.

Windows 10 in tablet mode

It is not recommended to use Windows 10 in tablet mode.
When running applications in tablet mode in Windows 10, for example Runtime Advanced,
Sinumerik Operate, etc., these applications are minimized after starting.

.Net-Controls in Runtime
If you have incorporated a .Net control in your project as "Custom .Net control", you have to
copy the files belonging to these controls to the installation directory of WinCC Runtime, e.g.
"C:\ProgramFiles\Siemens\Automation\WinCC RT Advanced". Otherwise, the control cannot
be loaded in runtime.

Disabling automatic checking for software updates

If the Engineering System is installed together with Runtime on a PC, the operator gets
notifications above software updates. For the system to run reliably on a multi-station system,
the same software version must be installed on all PCs.
It is possible to disable the automatic checking for software updates and to thus improve
performance.
To disable the automatic checking for software updates, go to "Settings > General > Software
updates" and deactivate the "Check for updates daily" option.

Access to array variables via OPC

If you use WinCC Runtime Advanced as an OPC UA server, reading array variables is only
supported if the "OPC UA Server Array index range access" setting is activated.
Array variables can only be written if the OPC UA client supports the setting "Write array
elements without IndexRange".

3.8.4 Notes on operation of Runtime Professional

Contents
Information that could not be included in the online help and important information about
product features.

Readme
Programming and Operating Manual, 11/2019 103
WinCC
3.8 Runtime

User authorizations within the operating system

1. All user must be added to the "SIMATIC HMI" user group. This also applies to users who
want to open WinCC projects remotely.
2. The storage folders of the projects must have the NTFS authorizations "SIMATIC HMI" with
full access and "SIMATIC HMI Viewer" with read access. The authorizations must be
inherited for all subordinate objects.

Locking shortcuts
If you want to lock shortcut keys in Windows, you must change the group policies in the
administrative tools of the operating system.
A detailed description of this can be found in the FAQ with the entry ID "44027453" in the
SIMATIC Customer Online Support:
Internet: WinCC FAQ 44027453 ([Link]
44027453)

Undocked toolbars
If the setting "Always on Top" is used for the Windows taskbar, undocked toolbars can be
hidden behind the Windows taskbar in Runtime. Follow the steps below to show the toolbars
again:
1. Select the "Properties" command in the shortcut menu of the taskbar.
2. Disable "Keep taskbar on top of other windows".

Fault in the connection between the server and the client

If the connection between the server and client is faulty, check the settings of the PG/PC
interface. TCP/IP(Auto) should not be used for the "Interface Parameter Assignment Used".
Used fixed IP addresses instead.

Fault in the connection between the server and the client

If the computer is simultaneously used as a server with the engineering system and a client
cannot establish the connection to the server, you should check the releases set on the server.
1. Exit Runtime on the server.
2. Select the command "Find computer..." in the shortcut menu of the network environment on
the desktop of the server.
3. Enter the name of the server as the computer to be found.
4. Open the computer found to see the shared directories.
5. Remove all the releases that begin with "WinCC_Project_HMI". Information on this is
available in the documentation for the operating system.
This malfunction is caused by the use of the command "Save as..." in conjunction with the
startup of the Runtime of this new project. You can make copies of the projects for backup

Readme
104 Programming and Operating Manual, 11/2019
 WinCC
3.8 Runtime

purposes using the "Save as..." command. You should, however, continue to work with the
original project.

Starting WinCC Runtime Professional

If Engineering System and Runtime are operated on one computer, Runtime or simulation for
a project opened in the Engineering System should only be started and ended using the TIA
Portal. Other options, for example, the symbol in the taskbar information area, should not be
used.
When you configure autostart on the client, you are required to enter the logon name and
password for each registered server project. To assign each server a logon name, the entry of
the respective project path must be confirmed with the "Apply" button. This means that you
must enter a logon name and password twice for redundant or alternative projects.

Setting the services for the SQL server

In order to ensure the full functionality of the SQL server for WinCC and WinCC Runtime, you
need to check the SQL server settings.
1. Start "Programme > Microsoft SQL Server 2014 > Configuration Tools > SQL Server 2014
Configuration Manager" in the Start menu.
2. Click "SQL Server Services" in the tree.
3. Check the services "SQL Server (WinCC)", "SQL Server (WINCCPLUSMIG)" and "SQL
Server Browser".
"Automatic" must be entered for "Start Mode".
"Log On As" must be entered for "LocalSystem" for "SQL Server (WinCC)".
"SQL Server Browser" must be entered for "LOCALSERVICE".
Change the settings, if necessary.
4. Click "SQL Server Network Configuration" in the tree.
5. Click "Protocols for WinCC".
6. Check the "TCP/IP" protocol. "Enabled" must be entered for "Status". Change the settings,
if necessary.

"Report system error" in WinCC Runtime Professional

The "Report system error" functionality is limited in WinCC Runtime Professional in conjunction
with an S7-300 or S7-400. In an alarm view, only one alarm is ever displayed for each
diagnostics type. Alarms on other errors of the same diagnostics type are not displayed.

Readme
Programming and Operating Manual, 11/2019 105
WinCC
3.8 Runtime

WinCC interface and 64-bit operating system

The open interfaces of WinCC Runtime Professional do not offer native 64-bit support. Runtime
API, VBS and the WinCC OleDB provider are primarily affected by this. To be able to use
WinCC interfaces with a 64-bit operating system, note the following:
- VB scripts cannot be started by simply double-clicking. You must explicitly use the 32-bit
version under "syswow64\[Link]".
- .NET applications that use the WinCC API have to be explicitly compiled as 32-bit
applications, not with "AnyCPU", but with "x86".
- C++ applications must not be compiled as 64-bit applications.

Dynamic graphics in WinCCViewer RT

If you use dynamic graphics from a graphics collection, e.g. linked with scripts, these graphics
are not updated in the WinCCViewer RT.
Select the "User-defined" option under "Runtime Settings > Graphic Settings".

Runtime Professional: Loading a project without connection to the configuration PC

Before you begin to load a project on the operator station, backup data such as "User
administration" and "Recipe data".
1. User administration data are overwritten by default.
Therefore, configure two buttons in your project for exporting and importing the user
administration with the system function "ExportUserManagement". The data only needs to
be exported if you have made changes to the user view in Runtime.
2. In the "Load preview" dialog, specify whether recipe data should be overwritten when
loading the project.
You can save recipe data in the recipe view using the operator controls "Export log" and
"Import log".
Note that the most recently imported or loaded data are used in Runtime.

Connection with S7-1200 in system diagnostics

Only a WinCC Runtime Professional HMI system can be connected with an S7-1200 (up to V3)
when you use system diagnostics.

Disabling automatic checking for software updates

If the Engineering System is installed together with Runtime on a PC, the operator gets
notifications above software updates. For the system to run reliably on a multi-station system,
the same software version must be installed on all PCs.
It is possible to disable the automatic checking for software updates and to thus improve
performance.
To disable the automatic checking for software updates, go to "Settings > General > Software
updates" and clear the "Check daily for updates" check box.

Readme
106 Programming and Operating Manual, 11/2019
 WinCC
3.8 Runtime

Restriction in the online delta loading capability

When you replace a design, the online delta loading capability of the project is lost. TIA Portal
does not output an error message in this case.

Screen objects in reports as PDF

The quality of the screen objects in the reports that you generate in Runtime as PDF files
depends on the PDF printer drivers used.

Projects in Runtime after Windows 10 update

You have installed Windows 10 version 1709 on a PC with WinCC Professional V15 and a PC
with WinCC Professional RT V15. You have performed a Windows 10 update to version 1803
on the Runtime PC. After the Windows 10 update, it may no longer be possible in Runtime to
manually open a project loaded from the engineering system PC.
Remedy: Set the start type of the service for the WinCC SQL instance manually to "Automatic
(Delayed Start)" and restart the system.

Memory requirement of logs

To calculate the memory requirement for alarms across all segments and for individual
segments, you need information on how many alarms are received as average per second. The
maximum memory requirement of an alarm of approx. 4000 bytes is taken into account. The
following applies:
Memory requirement = Number of alarms/s * 4000 bytes * 60 s/min * 60 min/h * 24 h/day * 31
days/month * y months.
The example is based on one alarm per second:
● The maximum size across all segments for 2 months is approx. 20 GB
● For a single segment it is approx. 330 MB per day
To calculate the storage requirements for data logs across all segments and for individual
segments, you need information about how many values are logged per second and the
average length of a process value. The following applies:
Memory requirement = number of log values/s * x bytes * 60 s/min * 60 min/h * 24 h/day * 31
days/month * y months
The example is based on 750 log values per second:
● For process values with 16 bytes, this results in a memory requirement of approx. 60 GB
● For process value with 6 bytes, this results in a memory requirement of approx. 22 GB

Readme
Programming and Operating Manual, 11/2019 107
WinCC
3.8 Runtime

3.8.5 Notes on operation of Runtime Unified

[Link] General information

Contents
Information that could not be included in the online help and important information about
product features.

Copying between WinCC Unified and other devices

Copying data between WinCC Unified and other devices, for example using the clipboard or the
library, is not supported.

Starting Runtime
Runtime cannot be started via WinCC Runtime Start if the "Load preview" dialog is displayed
in the engineering system.

Delta download
Many changes to the configuration can be loaded into Runtime with the setting "Only changes".
The following changes require a full compile and full load:

Configuration changes in the Type of change

area
HMI device Deletion of devices
Runtime settings Change of the system ID
Logging Changes to database type and storage location
Deletion of a data log
All changes to the configuration of logging tags
All changes to the configuration of alarm logs.
Faceplates All changes to faceplate type and tag interface
Parameter sets All changes to the configuration
Unified Collaboration All changes to the configuration
Language & font All changes to the configuration
Styles All changes to the configuration
Tags Deletion of array tags and user data types
All changes to the configuration of array tags and user data types
Connections All changes to the configuration
Cycles All changes to the configuration
Plant objects and plant views All changes to the configuration

Readme
108 Programming and Operating Manual, 11/2019
 WinCC
3.8 Runtime

Unified Collaboration
Notes on configuration and commissioning of Unified Collaboration is available in the Siemens
Industry Online Support ([Link]
dtp=Manual&mfn=ps&pnid=24212&lc=en-WW) in the "WinCC Engineering V16 - Unified
Runtime" manual.

"Keep current user management data in Runtime" option during complete download
To prevent the users created in User Management from being overwritten in Runtime by the
complete download of the project, activate the "Keep current user management data in
Runtime" option.
When this option is activated, role assignments and function rights from the user management
of the engineering system are loaded to Runtime, but not user data such as user name and
password.

Storage location of logs

It must be ensured that the "WCCILScsService" service user under which Runtime is running
has read and write rights to the directory in which the logs are stored. You have the following
options here:
● Configure the directory for the logs with the tool "WinCC Unified - Configuration" and
configure the storage of logs in this directory or its subdirectories in the engineering system.
● In the engineering system, configure the storage of logs in directories for which no restriction
of the access rights is configured in the operating system. However, this means that the logs
are then not protected from access by third parties.

Segment sizes of logs

For SQLite, the segment size of a log is always an integer multiple of 4 MB. This means that,
if you configure a segment size of 7 MB, the actual segment size is 8 MB.
For MSSQL, the smallest segment size of a log is 3 MB.

Memory of SQL server

If you want to access a large number of log values within a short time, it is advisable to set the
maximum memory of the SQL server to at least 4 GB in the "WinCC Unified – Configuration"
tool.

Communication via OPC UA

If you want to use WinCC as an OPC UA client, the OPC server must be located on the same
HMI device as WinCC.

Readme
Programming and Operating Manual, 11/2019 109
WinCC
3.8 Runtime

Changes at a PLC user data type

After a change at a PLC user data type, the PLC must be compiled to make this change known
to all Unified devices that use this user type. If compilation of the PLC does not take place, error
messages can occur during the compilation of the HMI devices.

[Link] Screens and screen objects

Contents
Information that could not be included in the online help and important information about
product features.

Screen objects for Unified Comfort Panel

These objects are supported in V16 only for Unified PC.
● Plant overview
● Reports
● f(x) trend view
● Media player
● Parameter set control
● Symbolic IO field
● Table view
● Trend companion
If you have configured these objects on a Unified Comfort Panel, you must delete these objects
before compilation.

Adaptations to screens and screen objects

The settings that you define under "Settings > Visualization" in the "Resize screen" area have
no effect on the HMI devices:
● SIMATIC Unified PC
● SIMATIC Unified Comfort Panel

Faceplates
PLC user data types, which contain an array of user data types must not be used with Unified
faceplates.

Editing SVG graphics

It is not possible to open SVG graphics in an external editor using the "Edit" command.

Readme
110 Programming and Operating Manual, 11/2019
 WinCC
3.8 Runtime

Scaling SVG graphics

If you use an SVG graphic as a background graphic in an element and scale it in the
Engineering System, the element is not displayed correctly in Chrome in runtime.

Unsupported SVG features

The following SVG features are not supported:
● Scripting - no inline-JavaScript
● Interactivity
● Styling
● Expandability - no ForeignObjects
● Animations

Text alignment in cells of the alarm view

You can define the spacing and alignment of text in the cells only for the entire alarm view.
The "Spacing" and "Text trimming" properties only have an effect in the "Graphic and Texts",
"Graphic or Text" and "Graphic" modes.

Popups and modal dialogs in the "Browser" control

Calls of queries and dialogs (pop-ups and modal dialogs) are only supported if they are
activated in the file <Path to WinCC Unified installation directory>WinCCUnified\WebRH\public
\content\custom\[Link]:
{"CustomSettings": {"HmiWebControl" : {"AllowPopups" :
true,"AllowModals" : true}}}

Note
Pop-ups and modal dialogs stop the update.

"Reports" control

Excel version
MS Excel 2016 - Build 16.0.6769 (32-bit or 64-bit) or corresponding online access to Excel
(Online Office 365) is installed on the device on which you want to use the Excel add-in.

Readme
Programming and Operating Manual, 11/2019 111
WinCC
3.8 Runtime

Placeholder for report names

The following placeholders are available in the "Reports" control to define names for the reports
to be generated:

Place‐ Description Example Range

holder Configura‐ Result
tion
{N} Automatic enumeration Rep_{N} Rep_1 1..9
{NN} Rep_{NN} Rep_01 01..99
{NNN} Rep_{NNN} Rep_001 001..999
{YY} Current year Rep_{YY} Rep_18 Valid year with 2 digits
{YYYY} Rep_{YYYY Rep_2018 Valid year with 4 digits
}
{m} Current month Rep_{m} Rep_1 Valid month, no prefixed 0 for months in single-digit range
{mm} Rep_{mm} Rep_01 Valid month, prefixed 0 for months in single-digit range
{mmm} Rep_{mm} Rep_Jan Month abbreviation with 3 characters
{mmmm} Rep_{mmm Rep_Jan‐ Month with full name
m} uary
{d} Current day of the month Rep_{d} Rep_1 Valid day, no prefixed 0 for days in single-digit range
{dd} Rep_{dd} Rep_01 Valid day, prefixed 0 for days in single-digit range
{ddd} Rep_{ddd} Rep_Mon Day abbreviation with 3 characters
{dddd} Rep_{dddd} Rep_Mon Day with full name
day
{h} Current hour Rep_{h} Rep_1 Current hour (12-hour clock), no prefixed 0 for single digit
values
{hh} Rep_{hh} Rep_01 Current hour (12-hour clock), prefixed by 0 for single-digit
values
{H} Rep_{H} Rep_13 Current hour (24-hour clock), no prefixed 0 for single-digit
values
{HH} Rep_{HH} Rep_13 Current hour (24-hour clock), prefixed by 0 for single-digit
values
{M} Current minute Valid minute, no prefixed 0 for single-digit values
{MM} Rep_{MM} Rep_06 Valid minute, prefixed by 0 for single-digit values
{s} Current second Rep_{s} Rep_41 Valid second, no prefixed 0 for single-digit values
{ss} Rep_{ss} Rep_41 Valid second, prefixed by 0 for single-digit values

Examples:

Placeholder Report name

LineA_{yyyymmdd}_{HHMMss}_{NNN} LineA_20190101_170001_003
LineA_{YYmmmd}_{hhMMss}_{NNN} LineA_19Jan1_050001_003

Readme
112 Programming and Operating Manual, 11/2019
 WinCC
3.8 Runtime

[Link] Alarm system and alarm display

Contents
Information that could not be included in the online help and important information about
product features.

Using alarm colors

To display the colors configured for an alarm in the alarm view, proceed as follows in the
engineering system:
1. Activate the property "Format > Use alarm colors" in the properties of the alarm view.
2. Activate the "Use alarm colors" property under "Alarm view > Columns" for each column that
to use the configured alarm color.

[Link] System functions and scripts

Contents
Information that could not be included in the online help and important information about
product features.

Apostrophe in object names

If you use an apostrophe in an object name and want to call this object from a script, you must
enclose the object name in quotation marks, for example:
let tag = Tags("My'Tag");

Memory allocation by scripts

In Runtime, there is no limitation of memory usage by scripts. Pay particular attention to the size
of the allocated memory when creating tags dynamically.

Floating-point numbers in Javascript

Javascript supports floating-point numbers with a mantissa up to 54 bits. In scripting and Web
client, values with a mantissa greater than 54 bit are therefore rounded.
This includes:
● Tag values
● Constants in the properties of screen objects

Note
Values with a mantissa of up to 64 bits are displayed correctly by IO fields.

Readme
Programming and Operating Manual, 11/2019 113
WinCC
3.8 Runtime

System function ExecuteReport

[Link] (reportTaskName)
In the reportTaskName parameter, you transfer the name of the report job that you use to
generate the report.

[Link] Libraries

Contents
Information that could not be included in the online help and important information about
product features.

Enabling library types

When releasing a type version in the library, note the message of the consistency check. To
ensure the project is compile free of error, ensure that only consistent versions of the library
types are released.

[Link] Notes on operation of Runtime Unified

Contents
Information that could no longer be included in the online help and important information about
product properties.

Process value indicator mode for slider

If you have configured a tag for the process value indicator mode property of a slider, changing
the tag in runtime has no effect on the slider.

Accessing Runtime Unified via Android devices or iOS devices

Ensure you have the latest operating system and browser version on your Android device or
iOS device if you want to access Runtime Unified with this device.

Synchronize client values with server time

By default, the following controls display values with client time:
● Alarm control
● Trend companion
● Trend control
● Function trend control
● Process control

Readme
114 Programming and Operating Manual, 11/2019
 WinCC
3.8 Runtime

To synchronize the time displayed on the client with the server, proceed as follows:
● iOS devices:
To prevent an iOS device from synchronizing with [Link], create a profile file and
upload it to the device.
Profile files enable time synchronization within a secure corporate network.
● Android devices:
Use a third-party app for time synchronization.

Using scripts during short cycle times

Synchronous calls of scripts during short cycle times can lead to overloads.

[Link] Working with plant objects and plant views

Contents
Information that could not be included in the online help and important information about
product features.

[Link] Internet browsers for WinCC Runtime Unified

WinCC Unified displays the runtime elements in HTML5. The browser used also has to support
this standard. Since the browsers interpret HTML5 differently, it is possible that objects are
displayed differently depending on the browser and the browser version used.
Compatibility tests were performed for the following browsers. The focus of the compatibility
tests was on the browsers marked with *:

Operating system Browser

Microsoft Windows ● Google Chrome*
● Microsoft Edge
● Mozilla Firefox, Mozilla Firefox ESR
Android ● Google Chrome*
● Firefox
● Edge
iOS, Mac ● Safari*
● Google Chrome
● Firefox
● Edge

Readme
Programming and Operating Manual, 11/2019 115
WinCC
3.8 Runtime

Browser recommendation
In view of the performance and support of the Runtime standard elements, Google Chrome has
proven to be the preferred browser. Its memory requirements are slightly higher than those of
the other browsers.

Note
Operating system and browser version
For Runtime operation via Android or iOS, always use the latest operating system.
Use the latest browser version.

Note
Performance differences in different versions of individual browsers
The browser versions can differ from each other, which can result in different behavior
regarding the memory requirements and speed.

Note
Suitability for continuous operation
MS Edge and Mozilla Firefox have proven to be problematic in continuous operation.

Known browser problems

The following restrictions apply to the following browsers:

Internet browser Limitation

MS Edge ● No screen change possible
● Very high utilization of memory in continuous operation
● The error message INET_E_RESOURCE_NOT_FOUND is
output when you open the started Runtime in MS Edge using the
address [Link] Use the address [Link]
WebRH to log on.
Mozilla Firefox ● High memory capacity utilization in continuous operation
Mozilla Firefox ESR ● Support of touch gestures for touch panels as of Firefox ESR V59
Google Chrome ● High memory capacity utilization in uninterrupted duty depending
on the version.
● On Android: Grid lines with a line width ≤1 are not displayed
correctly. This is due to the browser's own line thickness
representation. As a solution, it is helpful to use a line width ≥1.
● No correct representation of elements that use an SVG graphic
as background graphic scaled in the Engineering System.

Restrictions to the various functions can also occur, such as the availability of the before and
after buttons in the controls.

Readme
116 Programming and Operating Manual, 11/2019
 WinCC
3.8 Runtime

Current information on browser problems

You can find up-to-date information on display problems in browsers at the Siemens Online
Support under the entry ID 109757952.

[Link] Activating and testing ASIA licenses

Overview
The license keys for WinCC Runtime Unified are available on the "License Key USB Hardlock"
license storage medium.
The licensed ASIA version is executable in parallel to the European version by switching to
Unicode.
The "License Key USB Hardlock" (dongle) checks the following conditions:
● WinCC GUI language
● Runtime language
● Asian characters are used in the WinCC project.
● Operating system settings

Note
It is not allowed to run WinCC in process mode without a valid license.
Delete configuration languages
If you do not have a license for an ASIA version and delete the Asian configuration languages,
the WinCC project continues to run in demo mode.
To disable Demo mode, close the WinCC project. When reopened it is recognized that the
WinCC project no longer requires licenses for an ASIA version.

Testing the validity of the licenses

If you start a correctly licensed WinCC version without the connected dongle, an error message
appears. The same error message appears after a few minutes if you disconnect the dongle
from the computer with a correctly licensed WinCC version.
If this error message does not appear, a non-licensed WinCC version is installed. No right of
usage for WinCC is available in this case. Uninstall this WinCC version and purchase a legally
licensed version of WinCC.
If necessary, contact WinCC Support and provide the serial number of your software version:
● [Link]
You can find the serial number on the "Certificate of License" (CoL).

Readme
Programming and Operating Manual, 11/2019 117
WinCC
3.8 Runtime

Working with the "License Key USB Hardlock"

Please note the following:
● Do not edit data on the "License Key USB Hardlock".
The actions not allowed include:
– Rename data
– Delete data
– Copy data to the "License Key USB Hardlock"
● Do not format the "License Key USB Hardlock".
● Do not remove the "License Key USB Hardlock" from the PC while WinCC is running.

NOTICE
Do not remove the "License Key USB Hardlock" dongle
If you remove the dongle from the computer, an error message is generated and WinCC
switches to Demo mode.
If you re-connect the dongle to the computer, the error message disappears and Demo mode
is disabled. WinCC works once again in licensed mode.

[Link] Readme WinCC Plant Intelligence Options

Security information

Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
security concept. Siemens’ products and solutions only form one element of such a concept.
Customers are responsible for preventing unauthorized access to their plants, systems,
machines and networks. Systems, machines and components should only be connected to the
enterprise network or the internet if and to the extent necessary and with appropriate security
measures (e.g. use of firewalls and network segmentation) in place.
Additionally, Siemens’ guidance on appropriate security measures should be taken into
account. For more information about industrial security, please visit
[Link] (.com/topics/global/en/industrial-security/Pages/
[Link])
Siemens’ products and solutions undergo continuous development to make them more secure.
Siemens strongly recommends that product updates are applied as soon as they are available

Readme
118 Programming and Operating Manual, 11/2019
 WinCC
3.8 Runtime

and that the latest product versions are always used. Use of product versions that are obsolete
or no longer supported may increase exposure to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS
Feed under
[Link] (.com/topics/global/en/industrial-security/Pages/
[Link])

See also
Industrial security (.com/topics/global/en/industrial-security/Pages/[Link])

Notes on use

Contents
Information that could not be included in the online help and important information about
product features.

Line Coordination

Contents
Information that could not be included in the online help and important information about
product properties.

Restriction for holding/restarting jobs

If you use the "Hold" and "Restart" commands when controlling the jobs, configure the
synchronization lines in the procedures in such a way that only the first or the last
synchronization points of the sequences are used.

Requirement for executing jobs

To run the jobs, it is necessary for all sequencers of a subunit used in a procedure to be
switched to automatic mode.
Make sure that no sequencer of a subunit used in a procedure is in manual mode. The
sequencers of the subunit used which are not yet used in the procedure also need to be
switched to automatic mode.

Sequence Execution

Contents
Information that could not be included in the online help and important information about
product properties.

Readme
Programming and Operating Manual, 11/2019 119
WinCC
3.8 Runtime

Performance Insight

Contents
Information that could not be included in the online help and important information about
product features.

Calendar

Contents
Information that could not be included in the online help and important information about
product properties.

Readme
120 Programming and Operating Manual, 11/2019
 WinCC
3.9 HMI devices

3.9 HMI devices

3.9.1 Notes on HMI devices

Contents
Information that could not be included in the online help and important information about
product features.

Unsupported HMI devices (as of TIA Portal V15)

All HMI devices with version 11.x are no longer supported as of TIA Portal V15.
The following HMI devices are no longer supported as of TIA Portal V15:
● WinAC MP 177, WinAC MP 277, WinAC MP 377
● Panels: OP and TP of the 70 series, 170 series and 270 series
● Multi Panels: Multi Panels of the 170 series, 270 series and 370 series
In order to use other devices in TIA Portal V15, for example Basic, Comfort or Mobile Panels,
that have been configured with version 11.x, change the device version of the device in
question.
The storage structure in the installation directory also no longer contains data for 11.0. This
helps to reduce the size of the TIA Portal installation package compared to the previous
versions.

Unsupported HMI devices (as of TIA Portal V15.1)

The following HMI devices are no longer supported as of TIA Portal V15.1:
● WinCC Runtime Advanced V11

Unsupported HMI devices (as of TIA Portal V16)

The following HMI devices are no longer supported as of TIA Portal V15.1:
● Mobile Panel with device version 12.x
● Comfort Panel with device version 12.x
● KP1500 Comfort with device version 13.x
● TP1500 Comfort with device version 13.x
● TP1900 Comfort with device version 13.x
● TP2200 Comfort with device version 13.x

Readme
Programming and Operating Manual, 11/2019 121
WinCC
3.9 HMI devices

Multi-key operation
Unintentional actions can be triggered by multi-key operation:
● When you are using a key device, you cannot press more than two function keys at the same
time.
● When you are using a touch device, a standard PC or a panel PC, you can only press one
function key or button at the same time.

HMI devices with high communication load

S7 Diagnostics should be enabled if a Panel is assigned many connections to PLCs or other
HMI devices. Otherwise, you will risk overloading the panel.

TS Adapter with Ethernet interface

If an HMI device is connected via Ethernet and a TS adapter, it can not be reset to factory
settings.

Simulation with real PLC connection

The access point used by the simulation is independent from the settings of the engineering
system and can only be altered in the Control Panel with the "Setting PG/PC Interface" tool. If
the PLC connection is terminated right after the start of the simulation with alarm 140001, you
should check the access point used by the simulation with "Setting PG/PC Interface".
1. Double-click "Setting PG/PC Interface" in the Control Panel. A dialog opens.
2. Select "S7ONLINE" in the "Access point of application" field as standard for HMI.
3. Select the interface in the "Interface Parameter Assignment Used" area.
4. Exit the "Set PG/PC Interface" dialog with OK.

Simulation of the Basic Panels

Use an output field in an alarm text to output an external tag. The content of this output field will
then always be displayed with "0" during simulation.

Basic Panels 2nd Generation

Basic Panel 2nd Generation support the Sm@rtServer option.
If you are not using a USB hub, select the USB port USB_X60.1 as storage path.

HMI devices with operating system Windows CE 5.0 or higher

Owing to a modified client-server communication security setting, the time difference between
the HMI device (client) and PC (server) must not exceed 1 day. If you back up recipe data from
the HMI device on a network drive, for example, make sure that the time is set correctly on the
PC (server) and the HMI device (client).

Readme
122 Programming and Operating Manual, 11/2019
 WinCC
3.9 HMI devices

Connection switch in the Control Panel with Basic Panels

If you use the "Override protected connection information" function, the following restriction
applies:
You cannot perform a connection switch in the Control Panel of a Basic Panel from a PLC
without a protection level to a PLC with a "Complete protection" level.

Printing alarms (Mobile Panel)

It is not possible to print alarms as PDF or HTML when the internal memory "/flash" is selected
as "Storage Location". To print alarms as PDF or HTML, select an SD memory card or a USB
stick as storage location.

DHCP on KTP 400 PN, KTP 700 PN and KTP 900 PN

Operation with DHCP is not recommended for the KTP 400 PN, KTP 700 PN and KTP 900 PN
devices.
In some circumstances, it is possible that the device will no longer boot. If that is the case,
detach the network cable and reboot the device. After successfully startup, assign a fixed IP
address.

Mobile Panel
Mobile Panels 2nd Generation can be configured with TIA Portal V16 in the device version V15.
The compiled project cannot be downloaded to these devices, however.
To work with Mobile Panels 2nd Generation in TIA Portal V16, an upgrade to at least device
version V15.1 is necessary.

Sm@rtServer with Mobile Panels

The evaluation of the safety operation via PROFIsafe is only guaranteed if the Sm@rtServer is
disabled on the panel.
The use of Sm@rtServer on devices without a safety function is not recommended.

Simulation of Basic Panels 2nd Generation

3D hardware acceleration of the graphics card should be enabled for simulating the Basic
Panels 2nd Generation.

Installing fonts
If you have installed new fonts on a panel with ProSave, you will need to restart the panel. The
duration of the runtime startup process depends on the number and size of fonts.

Readme
Programming and Operating Manual, 11/2019 123
WinCC
3.9 HMI devices

Interruption of the DH485 connection

If you connect the Ethernet cable to the "PN_X1" connector of the HMI panel with Comfort
Panels, the DH485 connection might be interrupted.
Remedy for Comfort Redesign/PRO Panels: When running the DH485 project on the HMI
Panel, use the connector "PN_X3(Gigabit)" for Ethernet communication.

VB "CDate" function (Comfort Panels)

You can only use the VB "CDate" function with static parameters on the following HMI devices:
● TP1200 Comfort Pro
● TP1500 Comfort Pro / V2
● TP1900 Comfort Pro / V2
● TP2200 Comfort Pro / V2

Readme
124 Programming and Operating Manual, 11/2019
 WinCC
3.9 HMI devices

Delete browser cache (panel)

If you notice that the loading of websites in the HTML browser takes significantly longer, this
might be caused by the browser cache. Execute the following VBS function in Runtime to delete
the browser cache. You can also configure this VBS function as regular task in the Task
Scheduler.

Sub T7_DeleteBrowserCache()
' delete Browsercache filled temporary objects

Dim fso, nFileIndex,sFileName, nFileAttr, folder

On Error Resume Next

' Variable to show script is active

SmartTags("DeleteBrowserCacheActive") = True

folder = "\flash\simatic\Browsercache\data7\"
' Windows CE
Set fso = CreateObject("[Link]")
' Get first item that matches path
sFileName = [Link](folder & "*.*")
nFileIndex = 0
'Get the rest of matches
Do While sFileName <> ""
nFileAttr = [Link](folder & sFileName)
If (nFileAttr And 16) <> 0 Then
[Link]("\flash\simatic\Browsercache\data7\"&sFileName&"\*.*")
If [Link] <>0 Then
[Link]
End If
End If
nFileIndex = nFileIndex + 1
sFileName = [Link]
Loop
Set fso = Nothing
SmartTags("DeleteBrowserCacheActive") = False
End Sub

See also
PI Mobile ([Link]

Readme
Programming and Operating Manual, 11/2019 125
WinCC
3.10 Add-ons

3.10 Add-ons

3.10.1 Sm@rtServer

Content
Information that could not be included in the online help and important information about
product features.

Opening SmartClient *.sac files under Windows 10

You save the data of the current SmartServer connection using the executable file
[Link] with the *.sac format. To open the files generated in this way automatically
under Windows 10, a *.sac file with [Link] must be opened once manually via the
selection button and dialog in [Link].

3.10.2 Audit

Contents
Information that could not be included in the online help and important information about
product properties.

WinCC Audit Viewer 7.2 Update

An update for manual installation is available for WinCC Audit Viewer 7.2, which can be
installed optionally.
Install the update for WinCC Audit Viewer 7.2 by running the "AuditViewer_V72_00_Upd1.exe"
file from the Support directory on the product DVD.

3.10.3 DataMonitor

Contents
Information that could no longer be included in the online help and important information about
product features.

Readme
126 Programming and Operating Manual, 11/2019
 WinCC
3.10 Add-ons

Removal of WinCC Runtime

If you also want to use DataMonitor after removing WinCC Runtime Professional, you have to
perform a repair of the installation as follows:
1. Open the Control Panel.
2. Double-click on "Add/Remove Programs".
3. Select "SIMATIC WinCC/DataMonitor client" in the list of programs installed
4. Click on the "Change/Remove" button.
5. Select the "Repair" setting in the WinCC/DataMonitor setup.

Excel-Workbook on a PC with Windows 7

If you operate Excel-Workbook on a PC with Windows 7, you need to disable the "Aero Glass"
display mode.

Channel diagnostics view

The "Channel diagnostics view" object is not supported by the option WinCC DataMonitor.

Time zone of Web parts

When you create and configure a Web part in a specific time zone in the Web center, the time
zone is stored in the Web center.
If the time zone is changed in the operating system, this can lead to an incorrect display of the
time in the Web part.

3.10.4 WebNavigator

Contents
Information that could not be included in the online help and important information about
product features.

Removal of WinCC Runtime

If you also want to use WebNavigator after removing WinCC Runtime Professional, you have
to perform a repair of the installation as follows:
1. Open the Control Panel.
2. Double-click on "Add/Remove Programs".
3. Select "SIMATIC WinCC/WebNavigator client" in the list of programs installed
4. Click on the "Change/Remove" button.
5. Select the "Repair" setting in the WinCC/WebNavigator setup.

Readme
Programming and Operating Manual, 11/2019 127
WinCC
3.10 Add-ons

Virus scanner Trend Micro OfficeScan

It is not recommended to use the virus scanner of Trend Micro OfficeScan in combination with
WebNavigator, as this virus scanner may have an adverse impact on screen loading times.

ProDiag overview, GRAPH overview and PLC code view

The WinCC option Web Navigator does not support the use of the WinCC objects "GRAPH
overview", "ProDiag overview" and "PLC code view".

Characters not permitted in WinCC WebNavigator

Use the characters of the ASCII character set in the picture names and project names. Do not
use any special characters or national special characters.

Channel diagnostics
The object "Channel diagnostics" is not supported by the option WinCC WebNavigator.

Delay when outputting the WebNavigator screens

Due to the Web server technology, it can occur that updated WebNavigator screens are output
with a delay in runtime.

3.10.5 WebUX

Contents
Information that could not be included in the online help and important information about
product features.

Automatic login
If automatic login is no longer desired, you must delete the browser history in the respective
browser.

3.10.6 Redundancy

Contents
Information that could not be included in the online help and important information about
product features.

Readme
128 Programming and Operating Manual, 11/2019
 WinCC
3.10 Add-ons

Name in configuration of a redundant system

Only the computer name of the HMI devices is relevant for the configuration of a redundant
system. You set the computer name of the HMI device in its operating system. The name of the
HMI device from the project tree is only used for identification of the HMI device in the project.

3.10.7 SIMATIC Information Server

Contents
Information that could not be included in the online help and important information about
product features.

Installation of SIMATIC Information Server and WinCC Runtime Professional on one PC

To set up the SIMATIC Information Server and WinCC Runtime Professional on one PC,
adhere to the following installation sequence:
1. Install WinCC Runtime Professional.
2. Install the Information Server.
If you do not follow the installation sequence, connection problems may occur.

Readme
Programming and Operating Manual, 11/2019 129
WinCC
3.10 Add-ons

Readme
130 Programming and Operating Manual, 11/2019
Safety 4
4.1 Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
security concept. Siemens’ products and solutions constitute one element of such a concept.
Customers are responsible for preventing unauthorized access to their plants, systems,
machines and networks. Such systems, machines and components should only be connected
to an enterprise network or the internet if and to the extent such a connection is necessary and
only when appropriate security measures (e.g. firewalls and/or network segmentation) are in
place.
For additional information on industrial security measures that can be implemented, please visit
([Link]
Siemens' products and solutions undergo continuous development to make them more secure.
Siemens strongly recommends that product updates are applied as soon as they are available
and that the latest product versions are used. Use of product versions that are no longer
supported, and failure to apply the latest updates may increase customers' exposure to cyber
threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS
Feed visit ([Link]

Readme
Programming and Operating Manual, 11/2019 131
Safety
4.2 Notes on use

4.2 Notes on use

Content
Notes that could not be taken into account in the online help and the manual.

The manual as PDF file

The "SIMATIC Safety - Configuring and Programming" manual was stored in the installation
folder of STEP 7 Professional or STEP 7 Basic in the "Manuals" subfolder during installation of
the STEP 7 Safety optional package.

Readme
132 Programming and Operating Manual, 11/2019
 Safety
4.3 Editing devices and networks

4.3 Editing devices and networks

4.3.1 General notes on devices and networks

Roaming User Profiles not supported

You cannot use STEP 7 Safety in a roaming user profile. The software has only limited
functionality under these circumstances. Contact your domain administrator if you have a
roaming user profile.

Installation of HSPs
Make that all HSPs required in the project are installed before you work with the project.

Configuring phase shifting for the F-OB

Assign phase shift parameters for an F-OB using the following formula:
Phase shift < Max_Cyc - Cyclic interrupt time

Readme
Programming and Operating Manual, 11/2019 133
Safety
4.4 Programming PLC

4.4 Programming PLC

4.4.1 General Notes on PLC Programming and on Acceptance

Content
Notes that could not be taken into account in the online help and the manual.

What do you need to observe with regard to the installation of STEP 7 Safety?
After the installation of STEP 7 Safety, your safety program will be shown as inconsistent in
the Safety Administration Editor. Initiate compilation of the safety program. You will obtain a
consistent safety program as a result. The collective F-signature of your safety program
remains unchanged.

Online functions
● It is not possible to open F-blocks via the Lifelist with STEP 7 Safety. You have to have the
corresponding project opened offline in order to use all of the online functions for F-blocks.
● Use the Safety Administration Editor for the offline-online comparison if you wish to view the
checksums of F-blocks.

Upgrading to STEP 7 Safety V16

● After upgrading a project that contains S7-300/400 F-CPUs, we recommend executing the
command "Compile > Software (rebuild all blocks)".
● The name of the F-I/O is a component of the name of the associated F-I/O DB. In earlier
versions of STEP 7 Safety, it was not always ensured that this component was identical to
the name of the F-I/O. This is corrected with the upgrade to STEP 7 Safety V15. This does
not change the functionality or the collective signature of your safety program. However,
since the names of the F-I/O DBs have changed, you should generate an up-to-date safety
summary after the upgrade and add it to your acceptance documents.

Supplement to the section "CTD: Count down (STEP 7 Safety V16)" and section "CTUD: Count up and
down (STEP 7 Safety V16)"
If you use the CTD or CTUD instruction with version 1.1 in a know-how-protected block, you
must open the block by entering the password before compiling in order to change the version
of the CTD or CTUD instruction to a version other than V1.1.
The same applies if you want to change the version of the CTD or CTUD instruction from a
version other than V1.1 to version V1.1.

Readme
134 Programming and Operating Manual, 11/2019
 Safety
4.4 Programming PLC

Compiling the safety program

The collective F-signature is determined in STEP 7 Safety V15.1 when you compile the safety
program and shown in the Safety Administration Editor under "Code signature". The collective
F-signature is valid but the safety program can still be inconsistent. This is the case when the
hardware configuration is not up-to-date (compiled).
Compile the hardware configuration to obtain a consistent safety program. The collective F-
signature does not change as a result.

Openness
Importing and exporting F-blocks is not supported by the Openness command set.

Start values of tags in the block interface

You can also assign start values in F-blocks for tags (e. g. in the static selection), and use
constants from the TAG table (global constants) or the CONST selection (local constants) for
this.
Note that the F-blocks which use global constants as start values must not be called as a multi-
instance because in this case the F-CPU can go into STOP. This is not the case when using
local constants as start values.
To avoid CPU STOP, you have to avoid using global constants as start values, or use only
single-instance calls for blocks where this is the case. This applies to the blocks themselves, as
well as for all blocks which call these blocks, including everything up to Main Safety (complete
call sequence).

Multiuser Engineering
Please note that in a local session, it is not possible to check in communication IDBs for Flexible
F-Link on the multi-user server. This means you have to make changes to the start values in the
server-project view, as they will otherwise be overwritten when updating the local session.

Readme
Programming and Operating Manual, 11/2019 135
Safety
4.4 Programming PLC

Readme
136 Programming and Operating Manual, 11/2019
SIMATIC Energy Suite Readme 5
5.1 Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
security concept. Siemens’ products and solutions only form one element of such a concept.
Customer is responsible to prevent unauthorized access to its plants, systems, machines and
networks. Systems, machines and components should only be connected to the enterprise
network or the internet if and to the extent necessary and with appropriate security measures
(e.g. use of firewalls and network segmentation) in place.
Additionally, Siemens’ guidance on appropriate security measures should be taken into
account. For more information about industrial security, please visit (http://
[Link]).
Siemens’ products and solutions undergo continuous development to make them more secure.
Siemens strongly recommends to apply product updates as soon as available and to always
use the latest product versions. Use of product versions that are no longer supported, and
failure to apply latest updates may increase customer’s exposure to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS
Feed under ([Link]

See also
Data protection (Page 138)

Readme
Programming and Operating Manual, 11/2019 137
SIMATIC Energy Suite Readme
5.2 Data protection

5.2 Data protection

Siemens observes the principles of data protection, in particular the principle of data
minimization (privacy by design). This means for this SIMATIC product, the product does not
process / save any personal information.

Readme
138 Programming and Operating Manual, 11/2019
 SIMATIC Energy Suite Readme
5.3 What's new in SIMATIC Energy Suite V16?

5.3 What's new in SIMATIC Energy Suite V16?

New features in Energy Suite V16

All major innovations of Energy Suite V16 are summarized below.

Load management
● Load management acts as a monitoring and controlling feature in Energy Suite. Load
management component ensures that the power and energy consumption does not exceed
the user defined limit power or energy value. Load management component contains a key
user defined element called as actors.
Load management program consists of blocks such as the following:
– Forecast block
– Control block
– Actor block
– Backup/Restore block
The Forecast block receives its input from the Infeed that is the acquisition object. For
example, in a power production plant, the infeed will be the input from the power grid. The
Forecast block calculates and forecasts the average power and energy value until the end
of an active time period.
Consider monitoring of a manufacturing plant through load management component. The
Forecast block reads the power value of the infeed, and monitors the power consumption.
The energy uitilization is constantly monitored against a threshold limit over a certain time
period. If the Forecast is exceeding the threshold value, the load Management triggers
consumer (actor) or producers to switch off state. This process is termed as escalation. Post
the threshold peak, when the power consumption is minimal or within the threshold limit
value, the producer (actor) are switched on. This process is termed as de-escalation.
● Delta generation for load management and acquisition objects is supported, where any
newly added or modified acquisition object/ load management actor blocks will be
appended to the existing blocks after generation. In case of deletion, only the selected
blocks will be deleted after generation without altering the existing blocks.
● Supports automatic creation of screen rules for Energy Suite blocks.
● Screen generation
– Supports automatic screen generation for Energy acquistion program for WinCC
Professional and Comfort devices.
– Supports automatic screen generation for load management program using WinCC
Professional devices.

Readme
Programming and Operating Manual, 11/2019 139
SIMATIC Energy Suite Readme
5.3 What's new in SIMATIC Energy Suite V16?

Enhancements
● Runtime performance optimizations to improve PLC cycle time usage in long runs of
acquisition.
● RT neutral delta energy program generation for energy acquisition and load management
is supported when there are delta changes like addition, modification of energy objects for
acquisition or actors of load management.
● During Energy Suite project configuration, when you add a new Acquisition object table, it
is mandatory to download WinCC.
● While adding acquisition objects into the Acquistion object table, it is mandatory to download
WinCC.

Readme
140 Programming and Operating Manual, 11/2019
 SIMATIC Energy Suite Readme
5.4 What's new in SIMATIC Energy Suite V15.1?

5.4 What's new in SIMATIC Energy Suite V15.1?

New features in Energy Suite V15.1

All important innovations compared to Energy Suite V15 are summarized here.

Optimization of the connection of measurement hardware as a source of energy data

● Energy Suite recognizes the following measurement hardware with the integrated interface
in STEP 7 (TIA Portal) or with the device master data file configured as an energy data
source:
– ET 200SP AI Energy Meter 480VAC HF
– Soft starter 3RW55
● Energy Suite recognizes the configuration of the above-mentioned measurement hardware
and automatically creates corresponding blocks during the generation of the energy
program.
● The Energy Suite library contains automatically installed faceplates for visualizing the
energy program.
● An Energy Suite project created in V15.0 with PLC archiving generates a data log file. The
same project when opened in V 15.1, TIA portal prompts you to upgrade the project to
V15.1. Post upgradation of the project to V15.1, a new data log file is created after
regeneration and download.

Readme
Programming and Operating Manual, 11/2019 141
SIMATIC Energy Suite Readme
5.5 What's new in SIMATIC Energy Suite V14 SP1?

5.5 What's new in SIMATIC Energy Suite V14 SP1?

News for Energy Suite V14 SP1

All important innovations compared to Energy Suite V14 are listed below.

Generation of the energy program for advanced energy data

● The following new commands for generating the energy program for advanced energy data
(e.g. currents, voltages, frequency, etc.) are available in the shortcut menu of the "Energy
objects" object in the project tree:
– Basic energy data
– Basic and advanced energy data
– Basic and advanced energy data (with minimum/maximum values)
● Energy Suite recognizes which energy data the respective measuring hardware can provide
and automatically creates the corresponding blocks while generating the energy program.
Additional information is available in the SIMATIC Energy Suite Operating Manual in the
section "Generating energy program".

Automatic creation of reports with the Energy Suite Export Tool

● New automatic generation of reports based on configurable report templates.
● The following automatic report cycles are available:
– Daily
– Weekly
– Monthly
– Yearly
● For fast error analysis, the error messages output in case of unexpected behavior are saved
locally under "C:\Program Files (x86)\Siemens\Automation\SCADA-RT_V11\WinCC\bin
\config".
Additional information is available in the SIMATIC Energy Suite Operating Manual in the
section "Evaluate energy data with Energy Suite Export Tool".

Detailed information and feedback on the generation progress

● The information and events for generating the energy program are displayed for better
transparency of the generation process.
● You can use the "Go to" function to jump to the position in the configuration that is relevant
for the respective event.
Additional information is available in the SIMATIC Energy Suite Operating Manual in the
section "Generating energy program".

Readme
142 Programming and Operating Manual, 11/2019
 SIMATIC Energy Suite Readme
5.5 What's new in SIMATIC Energy Suite V14 SP1?

Expanding the meta data structure

The meta data structure of the energy objects has been expanded for reasons of compatibility
and analysis.
Additional information is available in the SIMATIC Energy Suite Operating Manual in the
section "Energy Suite blocks".

Readme
Programming and Operating Manual, 11/2019 143
SIMATIC Energy Suite Readme
5.6 Migration of a project from Energy Suite V14 SP1

5.6 Migration of a project from Energy Suite V14 SP1

To migrate Energy Suite projects of version V14 SP1 to V16, you must manually set the STEP 7
instruction "Get_IM_Data" to the current version. Otherwise you will encounter compilation
errors during the compilation process.

Requirements
● An Energy Suite project of version V14 SP1 is available.
● TIA Portal V16 with Energy Suite V16 is installed.

Procedure
To avoid a compilation error during migration of an Energy Suite project from V14 SP1 to V16,
follow these steps.
1. Open the project created in Energy Suite V14 SP1 in V16.
The "Open project" dialog opens.
2. Click the "Upgrade" button in the "Open project" dialog.
3. After the project has been migrated successfully, open the configured SIMATIC
S7-1500 CPU in the project tree.
4. Open any block (OB, FB or FC) below the "Program blocks" folder.
5. In the "Instructions" task card, open the folder "Extended instructions > Diagnostics".
The "Get_IM_Data" instruction is preset with version "V1.2".
6. Select the version "V1.3" from the drop-down list.
7. Then continue generating your energy program.
8. Below the configured S7-1500 CPU, click on the "Program blocks" object.
9. Select the "Compile > Software (complete compile)" command in the shortcut menu.
The energy program is compiled. You can check to see if the compiling has been
successfully completed in the Inspector window under "Info > Compile".
To avoid Library version conflict error during migration of Energy Suite projects of V15 and
below to V16:
● For basic instructions "Serialize" and "Deserialize", you must manually upgrade the version
from V2.0 to V2.1.
● For extended instruction "GetSMCinfo", you must manually upgrate the version from V1.0
to V1.1.

Readme
144 Programming and Operating Manual, 11/2019
 SIMATIC Energy Suite Readme
5.7 Notes on use

5.7 Notes on use

Contents
The information in this readme has priority over statements made in other documents.
Please read the following notes carefully, as they contain important information on installation
and use. Read these notes before you start the installation.
You can also find updated information on Energy Suite in the Siemens Industry Online Support
Portal.
Information on operating instructions of the SIMATIC Energy Support Library can be found in
the readme "[Link]" on the installation medium.

Upgrading projects
An Energy Suite project created in lower versions of V16 with PLC archiving generates a data
log file. The data log file scenarios are:
● When you are upgrading an Energy Suite project generated with version lower than v16 to
v16, and downloading the project to PLC without program generation will lead to PLC
archiving to be continued in the same data log file.
● When you are upgrading an Energy Suite project generated with version lower than v16 to
v16 with program generation, and downloading the project to PLC will lead to PLC archiving
to be performed in new data log file.
● In case of delta generation, existing DB block numbers change after upgrading projects to
v16.
● When upgrading projects that were generated with an Energy Suite version lower than v15
to v16, you must manually delete the LAcycCOM blocks as soon as the project has been
updated and then generate the energy program again.
● LAcycCom_RequestBuffer DB is available under Ens Program blocks.
● Projects of version v14 SP1 or v15 when upgraded to v16 with firmware version of v2.8, and
forecast option enabled in the Energy object table with Load management actors
configured, upon compilation the Ens_LmgtBackupRestore FB displays compilaton error.
● Projects of version v14 SP1 or v15 when upgraded to v16 with datalog exceeding 26
characters, generating a program will fail.

Energy Suite in multiuser project

Open a multiuser project only in the server project view, not in the local session.

Energy data from measurement hardware

When configuring the measurement hardware as an energy data source, different data type
settings are evaluated depending on the measurement hardware used.

Readme
Programming and Operating Manual, 11/2019 145
SIMATIC Energy Suite Readme
5.7 Notes on use

The following table shows the required settings for the supported measurement hardware:

Measurement hardware Energy data type Unit Normalization Overflow value

factor
AI EnergyMeter 480VAC ST Energy counter Wh 1 [Link].000.
value 000 = 1 * 10^15 (*)
AI EnergyMeter 480VAC HF Energy counter Wh 1 [Link].000.
value 000 = 1 * 10^15 (*)
SENTRON PAC3200/ Energy counter Wh 1 1 * 10^12
PAC4200 value
SENTRON 3VA (8er ETU) Energy counter Wh 1 4 * 10^12
value
SINAMICS AC/AC Power value W 1 -
SIMOCODE pro V PN Energy counter Wh 1 [Link].000
value
Motor starter ET 200SP/ Power value W 1 -
M200D
Soft starter 3RW44 Power value W 1 -
Soft starter 3RW55 Power value W 1 -

(*) Make sure that the energy counter value shows the overflow value both in the Energy Suite
settings and in the hardware configuration of the AI EnergyMeter 480VAC ST/HF. You can find
the hardware configuration in the Inspector window "Properties" under "Module parameters >
AI configuration > Measurement > End value energy meter".
Make sure that the parameter assignment corresponds to the above table

Transfer of data to the SCADA system

If you make changes to the energy program, generate the energy program again and load it to
the CPU.
Load the changes to the CPU only if the buffer blocks are empty. When loading to the CPU
(complete), the CPU must be restarted afterward. When loading to the CPU (only changes), a
reinitialization of the "EnS_BufferWorkDB" data block must be performed. You can find
additional information on this in the online help of the TIA Portal information system.

Generating the energy program

Check the following settings if generation of the energy program fails:
● Energy data source: The following aspects should be configured according to the manual:
– Hardware configuration of the measurement hardware (see documentation
"Measurement Hardware for SIMATIC Energy Suite in the TIA Portal")
– Data type (see section "Energy data from data blocks")
– Naming conventions (see section "Performance features and conventions")
● Archiving period: An archiving period is assigned to each energy object.

Readme
146 Programming and Operating Manual, 11/2019
 SIMATIC Energy Suite Readme
5.7 Notes on use

● Energy object name: Energy object cannot have the same name as the following objects
– Program block
– Technology object
– External source
– PLC tag
– PLC data type
● General: The prefixes "EnS_" (except "EnS_EEm_" for S7 Energy Efficiency Monitor),
"EnSL_", and "LAcycCom_" are reserved system prefixes and are not used in the names of
the objects specified above.
Before regenerating the energy program, make sure that the settings specified above apply.
● The value range for load management supports 1-26 characters.
● The value range for priority actor supports 1-1999 characters.
For successful compilation of Comfort panel devices containing Load management and energy
data acquistion along with SiVArc generation:
● The HMI tags of type LMGT - Internal tags and EnS_Visu need to be manually deleted since
these are not supported with WinCC Comfort.
● You must link the appropriate tags for the pop-up screen objects.
● With only energy acquistion program generated in PLC and screens are generated through
the option" Start SiVArc generation with station selection dialog", you must manually delete
the tag table “LMGT - Internal tags”.
While configuring Energy Suite project,
● Adding Energy acquisition object table for the first and consecutive times, it is mandatory
to download the WinCC.
● Adding acquisition objects to the Energy acquisition table, it is mandatory to download the
WinCC.

Energy Suite blocks

EnS_CalcEnergyData: Calculating energy values
Resetting the energy counter value during an active archiving period results in the calculation
of negative energy values for this archiving period.
EnSL_DrvBasic_Sina_vx: Acquire basic energy data
Contrary to the information in the documentation "Measurement hardware for
SIMATIC Energy Suite in TIA Portal", the error code "W#16#8011" does not exist at the output
parameter "status".

Readme
Programming and Operating Manual, 11/2019 147
SIMATIC Energy Suite Readme
5.7 Notes on use

HMI Tags limit

In the HMI runtime settings, PLC name is appended with Tag name if "PLC name as prefix in
the HMI tag name" checkbox is enabled. After SiVArc screen generation, followed by HMI
compilation, an error is displayed if the HMI tag name exceeds 128 characters.

Readme
148 Programming and Operating Manual, 11/2019
TIA Portal Version Control Interface 6
6.1 Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, systems, machines and networks.
In order to protect plants, systems, machines and networks against cyber threats, it is
necessary to implement – and continuously maintain – a holistic, state-of-the-art industrial
security concept. Siemens’ products and solutions only form one element of such a concept.
Customer is responsible to prevent unauthorized access to its plants, systems, machines and
networks. Systems, machines and components should only be connected to the enterprise
network or the internet if and to the extent necessary and with appropriate security measures
(e.g. use of firewalls and network segmentation) in place.
Additionally, Siemens’ guidance on appropriate security measures should be taken into
account. For more information about industrial security, please visit
[Link] ([Link]
company/topic-areas/future-of-manufacturing/[Link])
Siemens’ products and solutions undergo continuous development to make them more secure.
Siemens strongly recommends to apply product updates as soon as available and to always
use the latest product versions. Use of product versions that are no longer supported, and
failure to apply latest updates may increase customer’s exposure to cyber threats.
To stay informed about product updates, subscribe to the Siemens Industrial Security RSS
Feed under
[Link] ([Link]
company/topic-areas/future-of-manufacturing/[Link])

Readme
Programming and Operating Manual, 11/2019 149
TIA Portal Version Control Interface
6.2 Notes on use

6.2 Notes on use

Contents
Information that could not be included in the online help and important information about
product characteristics.

Readme
150 Programming and Operating Manual, 11/2019
Index

. H
.Net service packs, 8 Hardware
.Net versions, 8 Detection, 33

A I
Asian, 8 I/O, 41, 42
IP address, 23
ISO transport, 34
C ISO‑on‑TCP, 34
Character string, 60
Characters, 8
Comparing library elements, 10
K
Compatibility, 21, 59 K parameter, 60, 61
Conversions, 63
Convert character string, 60
CP 343-2, 31 L
Library, 10
Loading
D from a device, 40
Deactivate, 63 Module comments, 30
Decimal places, 9
DEMUX, 61
M
Memory card, 11
E Removal/insertion, 11
EC31-RTX, 31 Migration of IP access protection lists when activating
ENO, 63 Security, 36
Ethernet module Migration of projects with Ethernet CPs and
Removal/insertion, 21 Security, 36
Module
Inserting, 21
F Removing, 21
Module comments, 30
Firmware loader ‑ Chinese GUI, 34
MUX, 60
Force job on SD card, 11
Force table
Changed display formats, 42
Function value, 61
N
Network, 40
Network drive, 8
G
Go online
Multiple TIA Portal instances, 22

Readme
Programming and Operating Manual, 11/2019 151
Index

O U
Online connection USB card readers, 11
Multiple TIA Portal instances, 22
Online operation, 22
Open force job, 11 V
Virtual environment, 12
VMware - PC CPs, 35
P
PLCSIM, 40
Private Cloud, 12 W
Program_Alarm, 61
Watch table
Changed display formats, 42
Loading data blocks during an active control
R job, 41
Return, 61 Multiple access to the same CPU, 41

S
S_CONV, 60
S7 routing, 34
S7-1200, 30
S7-1200 modules, 30
S7-Port Configuration Tool, 23
SD card, 11
Security, 40
Security online diagnostics of S7 CPs, 37
SET, 60
SIMATIC S7 Embedded Controller, 31
Special diagnostics, 33
Special diagnostics ‑ Chinese GUI, 34
STRING, 63

T
TiaDefaultProjectPath, 12
TiaUserSettingsPath, 12
Trace
Deleting measurements, 33
Deleting measurements in the device, 33
Deleting measurements on the memory card, 33
Open Controller, 33
Project trace for Open Controller, 33
Project trace for Software Controller, 33
Software Controller, 33
TSAP length, 34

Readme
152 Programming and Operating Manual, 11/2019